Remote Services T0886

ICS Tactics: Initial Access, Lateral Movement

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (12 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
AlertName2contains 1, eq 1Unauthorized SSH Access, internet
ProviderName2eq 2IoTSecurity
isNew2eq 2True
Active1eq 1true
ClientIp1is_not_null 1
DataverseActivity_TimeGenerated1cross_field_compare 1ExpirationDateTime
DeviceProduct1eq 1isid
EmailSourceIpAddress1is_not_null 1
EventClassID1in 1156, 161, 169
NetworkDestinationIP1is_not_null 1
NetworkIP1is_not_null 1
NetworkSourceIP1is_not_null 1

Top indicator values (16 distinct)

These values appear most often in rule predicates.

Exclusions (16 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
ClientIpcidr_match
10.0.0.0/8
1
ClientIpcidr_match
127.0.0.0/8
1
ClientIpcidr_match
169.254.0.0/16
1
ClientIpcidr_match
172.16.0.0/12
1
ClientIpcidr_match
192.168.0.0/16
1
ClientIpstarts_with
127.
1
ClientIpstarts_with
::
1
ClientIpstarts_with
fe80
1
TI_ipEntitycidr_match
10.0.0.0/8
1
TI_ipEntitycidr_match
127.0.0.0/8
1
TI_ipEntitycidr_match
169.254.0.0/16
1
TI_ipEntitycidr_match
172.16.0.0/12
1
TI_ipEntitycidr_match
192.168.0.0/16
1
TI_ipEntitystarts_with
127.
1
TI_ipEntitystarts_with
::
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Kusto 4 rules