Rootkit `T0851`

ICS Tactics: Evasion, Inhibit Response Function

Authoring guide

These 1 rule share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeviceProduct`	1	`eq` 1	`isid`
`EventClassID`	1	`in` 1	`176`, `178`, `181`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeviceProduct`	`eq`	`isid` kustoRadiflow - Suspicious Malicious Activity Detected	1	8
`EventClassID`	`in`	`176` kustoRadiflow - Suspicious Malicious Activity Detected	1
`EventClassID`	`in`	`178` kustoRadiflow - Suspicious Malicious Activity Detected	1
`EventClassID`	`in`	`181` kustoRadiflow - Suspicious Malicious Activity Detected	1
`EventClassID`	`in`	`57` kustoRadiflow - Suspicious Malicious Activity Detected	1
`EventClassID`	`in`	`58` kustoRadiflow - Suspicious Malicious Activity Detected	1
`EventClassID`	`in`	`59` kustoRadiflow - Suspicious Malicious Activity Detected	1
`EventClassID`	`in`	`60` kustoRadiflow - Suspicious Malicious Activity Detected	1

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application