Valid Accounts `T0859`

ICS Tactics: Persistence, Lateral Movement

Authoring guide

These 7 rules share fields, values, and exclusions.

Fields filtered most (30 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`LogType`	2	`eq` 1, `in` 1	`Update`, `Insert`
`TableName`	2	`eq` 2	`BankAccountTable`, `SysAADClientTable`, `UserInfo`
`Active`	1	`eq` 1	`true`
`Anomalies`	1	`gt` 1	`0`
`BankUpdated`	1	`cross_field_compare` 1	`AliasUpdated`
`ClientIp`	1	`is_not_null` 1
`CurrentAccountNum`	1	`cross_field_compare` 1	`OldAccountNum`
`CurrentAlias`	1	`cross_field_compare` 1	`PreviousAlias`
`DataverseActivity_TimeGenerated`	1	`cross_field_compare` 1	`ExpirationDateTime`
`EmailSourceIpAddress`	1	`is_not_null` 1
`EntityName`	1	`eq` 1	`systemuser`
`LogCreatedBy`	1	`cross_field_compare` 1	`MappedUser`
`MappedUser`	1	`eq` 1	`[]`
`Message`	1	`eq` 1	`Create`
`Name`	1	`eq` 1	`applicationid`

Top indicator values (32 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Active`	`eq`	`true` kustoDataverse - TI map IP to DataverseActivity	1	70
`Anomalies`	`gt`	`0` kustoDataverse - Anomalous application user activity	1	6
`BankUpdated`	`cross_field_compare`	`AliasUpdated` kustoF&O - Bank account change following network alias reassignment	1
`CurrentAccountNum`	`cross_field_compare`	`OldAccountNum` kustoF&O - Bank account change following network alias reassignment	1	2
`CurrentAlias`	`cross_field_compare`	`PreviousAlias` kustoF&O - Bank account change following network alias reassignment	1
`DataverseActivity_TimeGenerated`	`cross_field_compare`	`ExpirationDateTime` kustoDataverse - TI map IP to DataverseActivity	1	2
`EntityName`	`eq`	`systemuser` kustoDataverse - New non-interactive identity granted access	1	3
`LogCreatedBy`	`cross_field_compare`	`MappedUser` kustoF&O - Non-interactive account mapped to self or sensitive privileged user	1
`LogType`	`eq`	`Update` kustoF&O - Bank account change following network alias reassignment	1	3
`LogType`	`in`	`Insert` kustoF&O - Non-interactive account mapped to self or sensitive privileged user	1
`LogType`	`in`	`Update` kustoF&O - Non-interactive account mapped to self or sensitive privileged user	1	2
`MappedUser`	`eq`	`[]` kustoF&O - Non-interactive account mapped to self or sensitive privileged user	1
`Message`	`eq`	`Create` kustoDataverse - New non-interactive identity granted access	1	2
`Name`	`eq`	`applicationid` kustoDataverse - New non-interactive identity granted access	1
`NewData`	`contains`	`00000007-0000-0000-c000-000000000000` kustoDataverse - New non-interactive identity granted access	1
`OperationName`	`eq`	`update application` kustoDataverse - New non-interactive identity granted access	1	3
`RoleCollection`	`in`	`Cloud Connector Administrator` kustoSAP BTP - User added to sensitive privileged role collection	1
`RoleCollection`	`in`	`Connectivity and Destination Administrator` kustoSAP BTP - User added to sensitive privileged role collection	1
`RoleCollection`	`in`	`Destination Administrator` kustoSAP BTP - User added to sensitive privileged role collection	1
`RoleCollection`	`in`	`Subaccount Administrator` kustoSAP BTP - User added to sensitive privileged role collection	1
`RoleCollection`	`in`	`Subaccount Service Administrator` kustoSAP BTP - User added to sensitive privileged role collection	1
`TableName`	`eq`	`BankAccountTable` kustoF&O - Bank account change following network alias reassignment	1	2
`TableName`	`eq`	`SysAADClientTable` kustoF&O - Non-interactive account mapped to self or sensitive privileged user	1
`TableName`	`eq`	`UserInfo` kustoF&O - Bank account change following network alias reassignment	1	2
`action`	`eq`	`grantPermissions` kustoSAP BTP - User added to Cloud Identity Service privileged Administrators list	1
`azure_ad::modified_properties_new`	`contains`	`permission` kustoSAP BTP - User added to Cloud Identity Service privileged Administrators list	1
`azure_ad::target_resources`	`contains`	`00000007-0000-0000-c000-000000000000` kustoDataverse - New non-interactive identity granted access	1
`changedAttribute`	`eq`	`authorizations` kustoSAP BTP - User added to Cloud Identity Service privileged Administrators list	1
`crudType`	`eq`	`CREATE` kustoSAP BTP - User added to sensitive privileged role collection	1
`group.name`	`contains`	`xs_rolecollection2user` kustoSAP BTP - User added to sensitive privileged role collection	1

Exclusions (16 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`ClientIp`	`cidr_match`	`10.0.0.0/8` kustoDataverse - TI map IP to DataverseActivity	1
`ClientIp`	`cidr_match`	`127.0.0.0/8` kustoDataverse - TI map IP to DataverseActivity	1
`ClientIp`	`cidr_match`	`169.254.0.0/16` kustoDataverse - TI map IP to DataverseActivity	1
`ClientIp`	`cidr_match`	`172.16.0.0/12` kustoDataverse - TI map IP to DataverseActivity	1
`ClientIp`	`cidr_match`	`192.168.0.0/16` kustoDataverse - TI map IP to DataverseActivity	1
`ClientIp`	`starts_with`	`127.` kustoDataverse - TI map IP to DataverseActivity	1
`ClientIp`	`starts_with`	`::` kustoDataverse - TI map IP to DataverseActivity	1
`ClientIp`	`starts_with`	`fe80` kustoDataverse - TI map IP to DataverseActivity	1
`TI_ipEntity`	`cidr_match`	`10.0.0.0/8` kustoDataverse - TI map IP to DataverseActivity	1
`TI_ipEntity`	`cidr_match`	`127.0.0.0/8` kustoDataverse - TI map IP to DataverseActivity	1
`TI_ipEntity`	`cidr_match`	`169.254.0.0/16` kustoDataverse - TI map IP to DataverseActivity	1
`TI_ipEntity`	`cidr_match`	`172.16.0.0/12` kustoDataverse - TI map IP to DataverseActivity	1
`TI_ipEntity`	`cidr_match`	`192.168.0.0/16` kustoDataverse - TI map IP to DataverseActivity	1
`TI_ipEntity`	`starts_with`	`127.` kustoDataverse - TI map IP to DataverseActivity	1
`TI_ipEntity`	`starts_with`	`::` kustoDataverse - TI map IP to DataverseActivity	1

Rules under this technique

These vendors publish rules tagged with this technique.