Exploitation for Privilege Escalation T1404

Mobile Tactic: Privilege Escalation

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (2 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EntityName1eq 1role
Message1eq 1Create

Top indicator values (2 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EntityNameeq
role
1
Messageeq
Create
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Microsoft 365

Domain: SaaS

Kusto 1 rule