Modify Parameter T0836

ICS Tactic: Impair Process Control

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
DeviceProduct1eq 1isid
EventClassID1in 1114, 115, 116
EventMessage1contains 1unauthorized

Top indicator values (9 distinct)

These values appear most often in rule predicates.

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application

Kusto 1 rule