Impair Defenses `T1629`

Mobile Tactic: Defense Evasion

Authoring guide

These 7 rules share fields, values, and exclusions.

Fields filtered most (28 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	3	`eq` 3	`AUDIT`, `DEVICE`, `THREAT`
`Name`	3	`eq` 3	`blockedattachments`, `enableipbasedcookiebinding`, `powerplatform.analytics.resource.tenant.isolation_policy.enabled`
`EntityName`	2	`eq` 2	`organization`
`Message`	2	`eq` 2	`Update`
`Value`	2	`eq` 2	`False`
`AuditType`	1	`in` 1	`CONFIGURATION_CHANGE`, `POLICY_CHANGE`, `SECURITY_SETTING_CHANGE`
`ChangeType`	1	`eq` 1	`UPDATE`
`ClientIp`	1	`is_not_null` 1
`DeviceComplianceStatus`	1	`in` 1	`Non-Compliant`, `Partial`
`DeviceSecurityStatus`	1	`in` 1	`THREATS_HIGH`, `THREATS_MEDIUM`
`Entities`	1	`contains` 1	`"appid":32780`
`EventOriginalType`	1	`eq` 1	`EnvironmentPropertyChange`, `TenantIsolationOperation`
`HistoricalAgents`	1	`cross_field_compare` 1	`UserAgent`
`HistoricalIPs`	1	`cross_field_compare` 1	`ClientIp`
`HistoricalTime`	1	`cross_field_compare` 1	`LatestEvent`

Top indicator values (38 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EntityName`	`eq`	`organization` kustoDataverse - Removal of blocked file extensions kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	2	4
`Message`	`eq`	`Update` kustoDataverse - Removal of blocked file extensions kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	2	5
`Value`	`eq`	`False` kustoDataverse - Guest user exfiltration following Power Platform defense impairment kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	2	3
`AuditType`	`in`	`CONFIGURATION_CHANGE` kustoLookout - Critical Audit and Policy Changes (v2)	1
`AuditType`	`in`	`POLICY_CHANGE` kustoLookout - Critical Audit and Policy Changes (v2)	1
`AuditType`	`in`	`SECURITY_SETTING_CHANGE` kustoLookout - Critical Audit and Policy Changes (v2)	1
`AuditType`	`in`	`USER_MANAGEMENT` kustoLookout - Critical Audit and Policy Changes (v2)	1
`ChangeType`	`eq`	`UPDATE` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`DeviceComplianceStatus`	`in`	`Non-Compliant` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`DeviceComplianceStatus`	`in`	`Partial` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`DeviceSecurityStatus`	`in`	`THREATS_HIGH` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`DeviceSecurityStatus`	`in`	`THREATS_MEDIUM` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`Entities`	`contains`	`"appid":32780` kustoDataverse - Guest user exfiltration following Power Platform defense impairment	1
`EventOriginalType`	`eq`	`EnvironmentPropertyChange` kustoDataverse - Guest user exfiltration following Power Platform defense impairment	1
`EventOriginalType`	`eq`	`TenantIsolationOperation` kustoDataverse - Guest user exfiltration following Power Platform defense impairment	1
`EventType`	`eq`	`AUDIT` kustoLookout - Critical Audit and Policy Changes (v2)	1
`EventType`	`eq`	`DEVICE` kustoLookout - Device Compliance and Security Status Changes (v2)	1
`EventType`	`eq`	`THREAT` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`HistoricalAgents`	`cross_field_compare`	`UserAgent` kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	1
`HistoricalIPs`	`cross_field_compare`	`ClientIp` kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	1
`HistoricalTime`	`cross_field_compare`	`LatestEvent` kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	1
`IPCount`	`gt`	`1` kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	1
`Identity`	`eq`	`Microsoft Invitation Acceptance Portal` kustoDataverse - Guest user exfiltration following Power Platform defense impairment	1
`Name`	`eq`	`blockedattachments` kustoDataverse - Removal of blocked file extensions	1
`Name`	`eq`	`enableipbasedcookiebinding` kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	1
`Name`	`eq`	`powerplatform.analytics.resource.tenant.isolation_policy.enabled` kustoDataverse - Guest user exfiltration following Power Platform defense impairment	1
`OperationName`	`eq`	`Update user` kustoDataverse - Guest user exfiltration following Power Platform defense impairment	1
`PropertyCollection`	`contains`	`property: securitygroupid, old value: , new value:` kustoDataverse - Guest user exfiltration following Power Platform defense impairment	1
`StartTime`	`cross_field_compare`	`GroupRemovalTimestamp` kustoDataverse - Guest user exfiltration following Power Platform defense impairment	1
`StartTime`	`cross_field_compare`	`TenantIsolationRemovalTimestamp` kustoDataverse - Guest user exfiltration following Power Platform defense impairment	1

Exclusions (2 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`user`	`ends_with`	`@microsoft.com` kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	1
`user`	`ends_with`	`@onmicrosoft.com` kustoDataverse - Unusual sign-in following disabled IP address-based cookie binding protection	1

Rules under this technique

These vendors publish rules tagged with this technique.