Software Discovery `T1418`

Mobile Tactic: Discovery

Authoring guide

These 3 rules share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	2	`eq` 2	`DEVICE`, `THREAT`
`ChangeType`	1	`eq` 1	`UPDATE`
`DeviceComplianceStatus`	1	`in` 1	`Non-Compliant`, `Partial`
`DeviceSecurityStatus`	1	`in` 1	`THREATS_HIGH`, `THREATS_MEDIUM`
`ThreatAction`	1	`eq` 1	`DETECTED`
`ThreatSeverity`	1	`in` 1	`CRITICAL`, `HIGH`
`ThreatStatus`	1	`in` 1	`ACTIVE`, `OPEN`
`entries`	1	`is_not_null` 1
`result_type`	1	`eq` 1	`maliciousness`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)
`ChangeType`	`eq`	`UPDATE` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`DeviceComplianceStatus`	`in`	`Non-Compliant` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`DeviceComplianceStatus`	`in`	`Partial` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`DeviceSecurityStatus`	`in`	`THREATS_HIGH` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`DeviceSecurityStatus`	`in`	`THREATS_MEDIUM` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`EventType`	`eq`	`DEVICE` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`EventType`	`eq`	`THREAT` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatAction`	`eq`	`DETECTED` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatSeverity`	`in`	`CRITICAL` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatSeverity`	`in`	`HIGH` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatStatus`	`in`	`ACTIVE` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatStatus`	`in`	`OPEN` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`result_type`	`eq`	`maliciousness` kustoQuokka - Malicious Results Detected	1

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application