Non-Standard Port T1509

Mobile Tactic: Command and Control

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (2 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
result_type1eq 1maliciousness
results.entries1is_not_null 1

Top indicator values (2 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
result_typeeq
maliciousness
1
results.entriesis_not_null
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application

Kusto 1 rule