Program Upload T0845

ICS Tactic: Collection

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (2 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
DeviceProduct1eq 1isid
EventClassID1in 1156, 161, 169

Top indicator values (10 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
DeviceProducteq
isid
18
EventClassIDin
156
1
EventClassIDin
161
1
EventClassIDin
169
1
EventClassIDin
171
1
EventClassIDin
182
1
EventClassIDin
183
1
EventClassIDin
184
1
EventClassIDin
185
1
EventClassIDin
5
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application

Kusto 1 rule