Valid Accounts `T0859`

ICS Tactics: Persistence, Lateral Movement

Authoring guide

These 7 rules share fields, values, and exclusions.

Fields filtered most (9 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`LogType`	2	`eq` 1, `in` 1	`Update`, `Insert`
`TableName`	2	`eq` 2	`SysAADClientTable`, `UserInfo`
`Active`	1	`eq` 1	`true`
`Message.object`	1	`contains` 1	`xs_rolecollection2user`
`OperationName`	1	`eq` 1	`Update application`
`OriginalObjectId`	1	`is_not_null` 1
`azure_ad::modified_properties_new`	1	`is_not_null` 1
`azure_ad::target_resources`	1	`contains` 1	`00000007-0000-0000-c000-000000000000`
`user`	1	`eq` 1	`application_users`

Top indicator values (12 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Active`	`eq`	`true` kustoDataverse - TI map IP to DataverseActivity	1	60
`LogType`	`eq`	`Update` kustoF&O - Bank account change following network alias reassignment	1	2
`LogType`	`in`	`Insert` kustoF&O - Non-interactive account mapped to self or sensitive privileged user	1
`LogType`	`in`	`Update` kustoF&O - Non-interactive account mapped to self or sensitive privileged user	1	2
`Message.object`	`contains`	`xs_rolecollection2user` kustoSAP BTP - User added to sensitive privileged role collection	1
`OperationName`	`eq`	`Update application` kustoDataverse - New non-interactive identity granted access	1	3
`OriginalObjectId`	`is_not_null`	kustoDataverse - Anomalous application user activity	1
`TableName`	`eq`	`SysAADClientTable` kustoF&O - Non-interactive account mapped to self or sensitive privileged user	1
`TableName`	`eq`	`UserInfo` kustoF&O - Bank account change following network alias reassignment	1	2
`azure_ad::modified_properties_new`	`is_not_null`	kustoSAP BTP - User added to Cloud Identity Service privileged Administrators list	1
`azure_ad::target_resources`	`contains`	`00000007-0000-0000-c000-000000000000` kustoDataverse - New non-interactive identity granted access	1
`user`	`eq`	`application_users` kustoDataverse - Anomalous application user activity	1

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 7 rules