Social Engineering T1684

Tactic: Stealth

Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (8 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
azure.signinlogs.properties.authentication_processing_details1contains 1user_impersonation
azure.signinlogs.properties.conditional_access_status1eq 1notapplied
azure.signinlogs.properties.token_issuer_type1eq 1azuread
azure.signinlogs.properties.token_protection_status_details.sign_in_session_status1eq 1unbound
azure_ad::authentication_requirement1eq 1singlefactorauthentication
azure_ad::user_type1eq 1member
data_stream.dataset1eq 1azure.signinlogs
event.outcome1eq 1success

Top indicator values (8 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
azure.signinlogs.properties.authentication_processing_detailscontains
user_impersonation
1
azure.signinlogs.properties.conditional_access_statuseq
notapplied
1
azure.signinlogs.properties.token_issuer_typeeq
azuread
12
azure.signinlogs.properties.token_protection_status_details.sign_in_session_statuseq
unbound
14
azure_ad::authentication_requirementeq
singlefactorauthentication
18
azure_ad::user_typeeq
member
111
data_stream.dataseteq
azure.signinlogs
136
event.outcomeeq
success
1369

Exclusions (19 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
aws::userAgentwildcard
Microsoft*Authentication*iPhone*
1
aws::userAgentwildcard
Mozilla*PKeyAuth/1.0
1
azure.signinlogs.properties.device_detail.operating_systemstarts_with
Android
1
azure.signinlogs.properties.device_detail.operating_systemstarts_with
Ios
1
azure_ad::app_idin
0000000c-0000-0000-c000-000000000000
1
azure_ad::app_idin
0a5f63c0-b750-4f38-a71c-4fc0d58b89e2
1
azure_ad::app_idin
48af08dc-f6d2-435f-b2a7-069abd99c086
1
azure_ad::app_idin
5e3ce6c0-2b1f-4285-8d4b-75ee78787346
1
azure_ad::app_idin
65d91a3d-ab74-42e6-8a2f-0add61688c74
1
azure_ad::app_idin
66a88757-258c-4c72-893c-3e8bed4d6899
1
azure_ad::app_idin
6bc3b958-689b-49f5-9006-36d165f30e00
1
azure_ad::app_idin
8c59ead7-d703-4a27-9e55-c96a0054c8d2
1
azure_ad::app_idin
95de633a-083e-42f5-b444-a4295d8e9314
1
azure_ad::app_idin
a5f63c0-b750-4f38-a71c-4fc0d58b89e2
1
azure_ad::app_idin
ab9b8c07-8f02-4f72-87fa-80105867a763
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Azure

Domain: Cloud

Elastic 1 rule