Exploitation of Remote Services T1428

Mobile Tactic: Lateral Movement

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Active1eq 1true
ClientIp1is_not_null 1
DataverseActivity_TimeGenerated1cross_field_compare 1ExpirationDateTime
EmailSourceIpAddress1is_not_null 1
NetworkDestinationIP1is_not_null 1
NetworkIP1is_not_null 1
NetworkSourceIP1is_not_null 1

Top indicator values (2 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Activeeq
true
170
DataverseActivity_TimeGeneratedcross_field_compare
ExpirationDateTime
12

Exclusions (16 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
ClientIpcidr_match
10.0.0.0/8
1
ClientIpcidr_match
127.0.0.0/8
1
ClientIpcidr_match
169.254.0.0/16
1
ClientIpcidr_match
172.16.0.0/12
1
ClientIpcidr_match
192.168.0.0/16
1
ClientIpstarts_with
127.
1
ClientIpstarts_with
::
1
ClientIpstarts_with
fe80
1
TI_ipEntitycidr_match
10.0.0.0/8
1
TI_ipEntitycidr_match
127.0.0.0/8
1
TI_ipEntitycidr_match
169.254.0.0/16
1
TI_ipEntitycidr_match
172.16.0.0/12
1
TI_ipEntitycidr_match
192.168.0.0/16
1
TI_ipEntitystarts_with
127.
1
TI_ipEntitystarts_with
::
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Microsoft 365

Domain: SaaS

Kusto 1 rule