Loss of Productivity and Revenue T0828

ICS Tactic: Impact

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventOriginalType1eq 1DeleteFlow
LogType1eq 1Update
TableName1eq 1BankAccountTable

Top indicator values (3 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventOriginalTypeeq
DeleteFlow
1
LogTypeeq
Update
12
TableNameeq
BankAccountTable
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Microsoft 365

Domain: SaaS

Kusto 2 rules