Unauthorized Command Message `T0855`

ICS Tactic: Impair Process Control

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (6 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeviceProduct`	2	`eq` 2	`isid`
`EventClassID`	2	`in` 2	`114`, `115`, `116`, `156`, `161`
`AlertName`	1	`contains` 1	`function code not supported by outstation`, `illegal bacnet message`, `illegal connection attempt on port 0`
`EventMessage`	1	`contains` 1	`unauthorized`
`ProviderName`	1	`eq` 1	`IoTSecurity`
`isNew`	1	`eq` 1	`True`

Top indicator values (80 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeviceProduct`	`eq`	`isid` kustoRadiflow - Policy Violation Detected kustoRadiflow - Unauthorized Command in Operational Device	2	8
`AlertName`	`contains`	`function code not supported by outstation` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`illegal bacnet message` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`illegal connection attempt on port 0` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`illegal dnp3 operation` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`illegal modbus operation (exception raised by master)` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`illegal modbus operation (function code zero)` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`illegal protocol version` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`incorrect parameter sent to outstation` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`initiation of an obsolete function code (initialize data)` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`initiation of an obsolete function code (save config)` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`modbus exception` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`new activity detected - lontalk network variable` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - ovation data request` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - read/write command (ams index group)` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - read/write command (ams index offset)` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - unauthorized deltav message type` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - unauthorized deltav roc operation` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - using ams protocol command` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - using siemens sicam command` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - using suitelink protocol command` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - using suitelink protocol sessions` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`new activity detected - using yokogawa vnetip command` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`omron fins unauthorized command` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`slave device received illegal` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`toshiba computer link unauthorized command` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`unauthorized abb totalflow file operation` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`unauthorized abb totalflow register operation` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`unauthorized access to siemens s7 plus object` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`unauthorized bacnet object access` kustoIllegal Function Codes for ICS traffic (Microsoft Defender for IoT)	1	2

Rules under this technique

These vendors publish rules tagged with this technique.

Unauthorized Command Message T0855

Authoring guide

Fields filtered most (6 distinct)

Top indicator values (80 distinct)

Rules under this technique

Kusto 3 rules

Unauthorized Command Message `T0855`