User Execution `T0863`

ICS Tactic: Execution

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Attachments.name`	2	`regex_match` 2	`(?i)^.*\.(doc\|docx\|docm\|pdf\|xls\|xlsx\|xlsm\|html\|zip)$(?-i)`
`ThreatLevel`	2	`eq` 2	`dangerous`, `suspicious`
`Active`	1	`eq` 1	`true`

Top indicator values (4 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Attachments.name`	`regex_match`	`(?i)^.*\.(doc\|docx\|docm\|pdf\|xls\|xlsx\|xlsm\|html\|zip)$(?-i)` kustoEgress Defend - Dangerous Attachment Detected kustoKnowBe4 Defend - Dangerous Attachment Detected	2	2
`ThreatLevel`	`eq`	`dangerous` kustoEgress Defend - Dangerous Attachment Detected kustoKnowBe4 Defend - Dangerous Attachment Detected	2	4
`ThreatLevel`	`eq`	`suspicious` kustoEgress Defend - Dangerous Attachment Detected kustoKnowBe4 Defend - Dangerous Attachment Detected	2	4
`Active`	`eq`	`true` kustoDataverse - TI map URL to DataverseActivity	1	60

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 4 rules