Project File Infection `T0873`

ICS Tactic: Persistence

Authoring guide

These 3 rules share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Active`	1	`eq` 1	`true`
`Malware`	1	`is_not_null` 1
`Message`	1	`contains` 1	`malware`
`user`	1	`is_not_null` 1

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Active`	`eq`	`true` kustoDataverse - TI map URL to DataverseActivity	1	60
`Malware`	`is_not_null`	kustoSAP BTP - Malware detected in BAS dev space	1
`Message`	`contains`	`malware` kustoSAP BTP - Malware detected in BAS dev space	1
`user`	`is_not_null`	kustoSAP BTP - Malware detected in BAS dev space	1	25

These vendors publish rules tagged with this technique.