Indicator Removal on Host `T1630`

Mobile Tactic: Defense Evasion

Authoring guide

These 2 rules share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	1	`eq` 1	`THREAT`
`ThreatAction`	1	`eq` 1	`DETECTED`
`ThreatSeverity`	1	`in` 1	`CRITICAL`, `HIGH`
`ThreatStatus`	1	`in` 1	`ACTIVE`, `OPEN`
`entries`	1	`is_not_null` 1
`result_type`	1	`eq` 1	`maliciousness`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)
`EventType`	`eq`	`THREAT` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatAction`	`eq`	`DETECTED` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatSeverity`	`in`	`CRITICAL` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatSeverity`	`in`	`HIGH` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatStatus`	`in`	`ACTIVE` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`ThreatStatus`	`in`	`OPEN` kustoLookout - High Severity Mobile Threats Detected (v2)	1
`result_type`	`eq`	`maliciousness` kustoQuokka - Malicious Results Detected	1

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application