Input Capture `T1417`

Mobile Tactics: Collection, Credential Access

Authoring guide

These 2 rules share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	1	`eq` 1	`SMISHING_ALERT`
`SmishingAlertSeverity`	1	`in` 1	`CRITICAL`, `HIGH`
`SmishingAlertType`	1	`in` 1	`CREDENTIAL_HARVESTING`, `FRAUD_DETECTION`, `PHISHING_DETECTION`
`entries`	1	`is_not_null` 1
`result_type`	1	`eq` 1	`maliciousness`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)
`EventType`	`eq`	`SMISHING_ALERT` kustoLookout - Critical Smishing and Phishing Alerts (v2)	1
`SmishingAlertSeverity`	`in`	`CRITICAL` kustoLookout - Critical Smishing and Phishing Alerts (v2)	1
`SmishingAlertSeverity`	`in`	`HIGH` kustoLookout - Critical Smishing and Phishing Alerts (v2)	1
`SmishingAlertType`	`in`	`CREDENTIAL_HARVESTING` kustoLookout - Critical Smishing and Phishing Alerts (v2)	1
`SmishingAlertType`	`in`	`FRAUD_DETECTION` kustoLookout - Critical Smishing and Phishing Alerts (v2)	1
`SmishingAlertType`	`in`	`PHISHING_DETECTION` kustoLookout - Critical Smishing and Phishing Alerts (v2)	1
`result_type`	`eq`	`maliciousness` kustoQuokka - Malicious Results Detected	1

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application