Supply Chain Compromise `T1474`

Mobile Tactic: Initial Access

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Active`	1	`eq` 1	`true`
`DataverseActivity_TimeGenerated`	1	`cross_field_compare` 1	`ExpirationDateTime`
`Fields`	1	`contains` 1, `is_not_null` 1	`http`
`Message`	1	`in` 1	`Create`, `Update`
`Url`	1	`is_not_null` 1
`entries`	1	`is_not_null` 1
`result_type`	1	`eq` 1	`maliciousness`

Top indicator values (6 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Active`	`eq`	`true` kustoDataverse - TI map URL to DataverseActivity	1	70
`DataverseActivity_TimeGenerated`	`cross_field_compare`	`ExpirationDateTime` kustoDataverse - TI map URL to DataverseActivity	1	2
`Fields`	`contains`	`http` kustoDataverse - TI map URL to DataverseActivity	1
`Message`	`in`	`Create` kustoDataverse - TI map URL to DataverseActivity	1	2
`Message`	`in`	`Update` kustoDataverse - TI map URL to DataverseActivity	1	2
`result_type`	`eq`	`maliciousness` kustoQuokka - Malicious Results Detected	1

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 2 rules