Exploitation for Privilege Escalation T0890

ICS Tactic: Privilege Escalation

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (8 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Category2eq 2ApplicationGatewayFirewallLog, FrontDoorWebApplicationFirewallLog
action_s2eq 2AnomalyScoring, Matched
Action1eq 1Blocked, Matched
DeviceProduct1eq 1iSID
EventClassID1in 1179, 34, 53
EventMessage1contains 1Exploit
Message1contains 1SQL Injection
details_msg_s1contains 1SQL Injection

Top indicator values (18 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Actioneq
Blocked
15
Actioneq
Matched
15
Categoryeq
ApplicationGatewayFirewallLog
12
Categoryeq
FrontDoorWebApplicationFirewallLog
14
DeviceProducteq
iSID
18
EventClassIDin
179
1
EventClassIDin
34
1
EventClassIDin
53
1
EventClassIDin
67
1
EventClassIDin
68
1
EventClassIDin
69
1
EventClassIDin
70
1
EventClassIDin
71
1
EventMessagecontains
Exploit
1
Messagecontains
SQL Injection
1
action_seq
AnomalyScoring
14
action_seq
Matched
12
details_msg_scontains
SQL Injection
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Kusto 4 rules