Exploitation for Privilege Escalation T0890

ICS Tactic: Privilege Escalation

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (13 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Category2eq 2ApplicationGatewayFirewallLog, frontdoorwebapplicationfirewalllog
Total_TransactionId2ge 23
action_s2eq 2Blocked, Matched, anomalyscoring, block
Action1eq 1Blocked, Matched
Blocked_Reason1contains 1sql injection attack
DeviceProduct1eq 1isid
EventClassID1in 1179, 34, 53
EventMessage1contains 1exploit
Message1contains 1sql injection
SQLI_Score1ge 110
TotalInboundScore1ge 115
Total_TrackingReference1ge 11
details_msg_s1contains 1sql injection

Top indicator values (25 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Total_TransactionIdge
3
26
Actioneq
Blocked
15
Actioneq
Matched
15
Blocked_Reasoncontains
sql injection attack
1
Categoryeq
ApplicationGatewayFirewallLog
12
Categoryeq
frontdoorwebapplicationfirewalllog
14
DeviceProducteq
isid
18
EventClassIDin
179
1
EventClassIDin
34
1
EventClassIDin
53
1
EventClassIDin
67
1
EventClassIDin
68
1
EventClassIDin
69
1
EventClassIDin
70
1
EventClassIDin
71
1
EventMessagecontains
exploit
1
Messagecontains
sql injection
1
SQLI_Scorege
10
1
TotalInboundScorege
15
12
Total_TrackingReferencege
1
12
action_seq
Blocked
12
action_seq
Matched
12
action_seq
anomalyscoring
14
action_seq
block
14
details_msg_scontains
sql injection
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Kusto 4 rules