Impair Defenses T1629
Mobile Tactic: Defense Evasion
Authoring guide
These 7 rules share fields, values, and exclusions.
Fields filtered most (13 distinct)
These fields appear most often in rule filters.
Top indicator values (23 distinct)
These values appear most often in rule predicates.
Rules under this technique
These vendors publish rules tagged with this technique.
Kusto 7 rules
- Dataverse - Guest user exfiltration following Power Platform defense impairment
- Dataverse - Removal of blocked file extensions
- Dataverse - Unusual sign-in following disabled IP address-based cookie binding protection
- Lookout - Critical Audit and Policy Changes (v2)
- Lookout - Device Compliance and Security Status Changes (v2)
- Lookout - High Severity Mobile Threats Detected (v2)
- Quokka - Malicious Results Detected