Project File Infection `T0873`

ICS Tactic: Persistence

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (10 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Message`	2	`contains` 1, `in` 1	`Create`, `Update`, `malware`
`Active`	1	`eq` 1	`true`
`DataverseActivity_TimeGenerated`	1	`cross_field_compare` 1	`ExpirationDateTime`
`Fields`	1	`contains` 1, `is_not_null` 1	`http`
`Malware`	1	`is_not_null` 1
`Operation`	1	`eq` 1	`FileUploaded`
`SourceFileExtension`	1	`in` 1	`bat`, `cmd`, `com`
`Url`	1	`is_not_null` 1
`m365::Workload`	1	`eq` 1	`SharePoint`
`user`	1	`is_not_null` 1

Top indicator values (22 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Active`	`eq`	`true` kustoDataverse - TI map URL to DataverseActivity	1	70
`DataverseActivity_TimeGenerated`	`cross_field_compare`	`ExpirationDateTime` kustoDataverse - TI map URL to DataverseActivity	1	2
`Fields`	`contains`	`http` kustoDataverse - TI map URL to DataverseActivity	1
`Message`	`contains`	`malware` kustoSAP BTP - Malware detected in BAS dev space	1
`Message`	`in`	`Create` kustoDataverse - TI map URL to DataverseActivity	1	2
`Message`	`in`	`Update` kustoDataverse - TI map URL to DataverseActivity	1	2
`Operation`	`eq`	`FileUploaded` kustoDataverse - Executable uploaded to SharePoint document management site	1	3
`SourceFileExtension`	`in`	`bat` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`cmd` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`com` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`cpl` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`exe` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`js` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`jse` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`msc` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`ps1` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`scr` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`vbe` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`vbs` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`wsf` kustoDataverse - Executable uploaded to SharePoint document management site	1
`SourceFileExtension`	`in`	`wsh` kustoDataverse - Executable uploaded to SharePoint document management site	1
`m365::Workload`	`eq`	`SharePoint` kustoDataverse - Executable uploaded to SharePoint document management site	1	3

Rules under this technique

These vendors publish rules tagged with this technique.

Project File Infection T0873

Authoring guide

Fields filtered most (10 distinct)

Top indicator values (22 distinct)

Rules under this technique

Kusto 3 rules

Project File Infection `T0873`