EXPLORE
← Back to Explore
T1484

Domain or Tenant Policy Modification

Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation. Modifications to domain or tenant settings may include altering domain Group Poli...

WindowsIdentity Provider
44
Detections
3
Sources
0
Threat Actors

BY SOURCE

31elastic12splunk_escu1sigma

PROCEDURES (19)

General Monitoring9 detections

Auto-extracted: 9 detections for general monitoring

Authentication Monitoring8 detections

Auto-extracted: 8 detections for authentication monitoring

Privilege3 detections

Auto-extracted: 3 detections for privilege

Exfiltrat3 detections

Auto-extracted: 3 detections for exfiltrat

Privilege3 detections

Auto-extracted: 3 detections for privilege

Token2 detections

Auto-extracted: 2 detections for token

Network Connection Monitoring2 detections

Auto-extracted: 2 detections for network connection monitoring

Persist2 detections

Auto-extracted: 2 detections for persist

Phish2 detections

Auto-extracted: 2 detections for phish

Api1 detections

Auto-extracted: 1 detections for api

Aws1 detections

Auto-extracted: 1 detections for aws

Service1 detections

Auto-extracted: 1 detections for service

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Email Security1 detections

Auto-extracted: 1 detections for email security

Remote1 detections

Auto-extracted: 1 detections for remote

Scheduled Task1 detections

Auto-extracted: 1 detections for scheduled task

Script Execution Monitoring1 detections

Auto-extracted: 1 detections for script execution monitoring

Privilege1 detections

Auto-extracted: 1 detections for privilege

Remote1 detections

Auto-extracted: 1 detections for remote

DETECTIONS (44)

Active Directory Privilege Escalation Identified
splunk_escu
AdminSDHolder SDProp Exclusion Added
elastichigh
Application Removed from Blocklist in Google Workspace
elasticmedium
Attempt to Deactivate an Okta Network Zone
elasticmedium
Attempt to Delete an Okta Policy Rule
elasticlow
Attempt to Modify an Okta Network Zone
elasticmedium
Attempt to Modify an Okta Policy
elasticlow
Attempt to Modify an Okta Policy Rule
elasticlow
AWS IAM OIDC Provider Created by Rare User
elasticmedium
AWS IAM SAML Provider Created
elasticmedium
AWS IAM SAML Provider Updated
elasticmedium
Changes to Device Registration Policy
sigmahigh
Creation or Modification of a new GPO Scheduled Task or Service
elasticlow
Deprecated - M365 Teams External Access Enabled
elasticmedium
Deprecated - M365 Teams Guest Access Enabled
elasticmedium
Domain Added to Google Workspace Trusted Domains
elastichigh
Entra ID Domain Federation Configuration Change
elastichigh
Entra ID Federated Identity Credential Issuer Modified
elastichigh
Google Workspace Admin Role Deletion
elasticmedium
Google Workspace Bitlocker Setting Disabled
elasticmedium
Google Workspace Password Policy Modified
elasticmedium
Google Workspace Restrictions for Marketplace Modified to Allow Any App
elasticmedium
Group Policy Abuse for Privilege Addition
elastichigh
M365 Exchange Anti-Phish Policy Deleted
elasticmedium
M365 Exchange DKIM Signing Configuration Disabled
elasticmedium
M365 Exchange Email Safe Link Policy Disabled
elasticmedium
M365 Exchange Federated Domain Created or Modified
elasticlow
M365 Exchange Malware Filter Rule Modified
elasticmedium
M365 SharePoint Site Sharing Policy Weakened
elasticmedium
M365 Teams Custom Application Interaction Enabled
elasticmedium
Microsoft Intune DeviceManagementConfigurationPolicies
splunk_escu
New Okta Identity Provider (IdP) Added by Admin
elasticmedium
Scheduled Task Execution at Scale via GPO
elasticmedium
Startup/Logon Script added to Group Policy Object
elasticmedium
Windows AD Dangerous Deny ACL Modification
splunk_escu
Windows AD Dangerous Group ACL Modification
splunk_escu
Windows AD Dangerous User ACL Modification
splunk_escu
Windows AD DCShadow Privileges ACL Addition
splunk_escu
Windows AD Domain Replication ACL Addition
splunk_escu
Windows AD Domain Root ACL Deletion
splunk_escu
Windows AD Domain Root ACL Modification
splunk_escu
Windows AD Hidden OU Creation
splunk_escu
Windows AD Object Owner Updated
splunk_escu
Windows AD Self DACL Assignment
splunk_escu