Protected User Data T1636

Mobile Tactic: Collection

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
action1eq 1UpdateSupportContactList
entries1is_not_null 1
result_type1eq 1maliciousness
status1eq 1SUCCESS

Top indicator values (3 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
actioneq
UpdateSupportContactList
1
result_typeeq
maliciousness
1
statuseq
SUCCESS
116

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Kusto 1 rule

Panther 1 rule