Masquerading T1655

Mobile Tactic: Defense Evasion

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
ChangeType1eq 1UPDATE
DeviceComplianceStatus1in 1Non-Compliant, Partial
DeviceSecurityStatus1in 1THREATS_HIGH, THREATS_MEDIUM
EventType1eq 1DEVICE

Top indicator values (6 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
ChangeTypeeq
UPDATE
1
DeviceComplianceStatusin
Non-Compliant
1
DeviceComplianceStatusin
Partial
1
DeviceSecurityStatusin
THREATS_HIGH
1
DeviceSecurityStatusin
THREATS_MEDIUM
1
EventTypeeq
DEVICE
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application

Kusto 1 rule