1200KM / detection
T1484 Domain or Tenant Policy Modification — Detection Rules
Detection workspace for T1484 Domain or Tenant Policy Modification: 1 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Changes to Device Registration Policy · test · high · {"product":"azure","service":"auditlogs"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0270 Detection of Domain or Tenant Policy Modifications via AD and Identity Provider
AN0755 Analytic 0755
Adversary modifies Group Policy Objects (GPOs), domain trust, or directory service objects via GUI, CLI, or programmatic APIs. Behavior includes creation/modification of GPOs, delegation permissions, trust objects, or rogue domain controller registration.
AN0756 Analytic 0756
Adversary modifies tenant policy through changes to federation configuration, trust settings, or identity provider additions in Microsoft 365/AzureAD via Portal, PowerShell, or Graph API. Includes setting authentication to federated or updating federated domains.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
- Active Directory Object Modification · DC0066
- Application Log Content · DC0038
- File Modification · DC0061
- Process Creation · DC0032
- User Account Authentication · DC0002
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.