Theft of Operational Information `T0882`

ICS Tactic: Impact

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (5 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`AlertName`	1	`contains` 1	`connection attempt to known malicious ip`, `invalid smb message (doublepulsar backdoor implant)`, `malicious domain name request`
`DeviceProduct`	1	`eq` 1	`isid`
`EventClassID`	1	`in` 1	`147`, `193`, `194`
`ProviderName`	1	`eq` 1	`IoTSecurity`
`isNew`	1	`eq` 1	`True`

Top indicator values (16 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`AlertName`	`contains`	`connection attempt to known malicious ip` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`invalid smb message (doublepulsar backdoor implant)` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`malicious domain name request` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`malware` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`suspicion of malicious activity` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`suspicion of remote code execution with psexec` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`suspicion of remote windows service management` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`suspicious executable file detected on endpoint` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`suspicious traffic detected` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1
`DeviceProduct`	`eq`	`isid` kustoRadiflow - Unauthorized Internet Access	1	8
`EventClassID`	`in`	`147` kustoRadiflow - Unauthorized Internet Access	1
`EventClassID`	`in`	`193` kustoRadiflow - Unauthorized Internet Access	1
`EventClassID`	`in`	`194` kustoRadiflow - Unauthorized Internet Access	1
`EventClassID`	`in`	`55` kustoRadiflow - Unauthorized Internet Access	1
`ProviderName`	`eq`	`IoTSecurity` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1	15
`isNew`	`eq`	`True` kustoSuspicious malware found in the network (Microsoft Defender for IoT)	1	15

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 2 rules