{"id":"T1484.002","name":"Trust Modification","url":"https://attack.mitre.org/techniques/T1484/002","tactics":["defense-impairment","privilege-escalation"],"platforms":["Identity Provider","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0458","stix_id":"x-mitre-detection-strategy--9e93c9d8-3e37-45ae-88d5-12914d98ba5a","name":"Detection of Trust Relationship Modifications in Domain or Tenant Policies","url":"https://attack.mitre.org/detectionstrategies/DET0458","analytics":[{"id":"AN1259","stix_id":"x-mitre-analytic--c84ed29d-c0bf-465c-9e4a-7685cd4ff444","name":"Analytic 1259","description":"Adversary modifies Active Directory domain trust settings via `netdom`, `nltest`, or PowerShell to add new domain trust or alter federation. Modifications occur in AD object attributes like trustDirection, trustType, trustAttributes, often paired with SeEnableDelegationPrivilege or certificate injection.","url":"https://attack.mitre.org/detectionstrategies/DET0458#AN1259","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=5136","data_component":"DC0066","data_component_name":"Active Directory Object Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4704","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ObjectType","description":"Focus on `trustedDomain` or `foreignSecurityPrincipal` AD objects in trust containers."},{"field":"AttributeModified","description":"Monitor attributes like `trustPartner`, `trustDirection`, `trustType`, `msDS-TrustForestTrustInfo`."},{"field":"TimeWindow","description":"Correlate trust creation with unusual logon events or certificate modifications."},{"field":"UserContext","description":"Flag rare accounts or non-standard admin users performing trust changes."}],"live":true,"detection_strategies":["DET0458"],"techniques":["T1484.002"]},{"id":"AN1260","stix_id":"x-mitre-analytic--a2d3072a-0f3a-46a1-a92e-f0d7ae030b48","name":"Analytic 1260","description":"Adversary adds federated identity provider (IdP) or modifies tenant domain authentication from Managed to Federated. Detected via API, PowerShell, or Admin Portal through federation events like `Set domain authentication`, `Add federated identity provider`, or `Update-MsolFederatedDomain`.","url":"https://attack.mitre.org/detectionstrategies/DET0458#AN1260","platforms":["Identity Provider"],"log_source_references":[{"name":"m365:unified","channel":"Set federation settings on domain|Set domain authentication|Add federated identity provider","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"},{"name":"azure:signinlogs","channel":"OperationName=SetDomainAuthentication OR Update-MsolFederatedDomain","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"azure-signinlogs"}],"mutable_elements":[{"field":"OperationName","description":"Identify rare trust-modification operations (SetDomainAuthentication, Update-MsolFederatedDomain)."},{"field":"InitiatedBy","description":"Flag federated trust changes performed by unknown users, service principals, or tokens."},{"field":"UserAgent","description":"Separate scripted/API interactions from GUI-based administrative changes."},{"field":"TimeWindow","description":"Correlate trust change to federated login or SAML token injection within short window."}],"live":true,"detection_strategies":["DET0458"],"techniques":["T1484.002"]}],"live":true,"version":"1.0","techniques":["T1484.002"]}],"sigma_rules":[{"id":"58f88172-a73d-442b-94c9-95eaed3cbb36","title":"New Federated Domain Added","author":"Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)","status":"test","level":"medium","date":"2023-09-18","modified":null,"description":"Detects the addition of a new Federated Domain.","references":["https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/","https://o365blog.com/post/aadbackdoor/"],"logsource":{"product":"m365","service":"audit"},"tags":["attack.privilege-escalation","attack.defense-impairment","attack.t1484.002"],"path":"rules/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml","techniques":["T1484.002"],"cves":[]},{"id":"fe04b26b-0ac4-45d7-9404-4b9f16a440a9","title":"Okta Session Impersonation Granted From Untrusted Domain","author":"zendannyy","status":"experimental","level":"medium","date":"2026-04-28","modified":null,"description":"Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session.\nThis event type \"user.session.impersonation.grant\" signifies that someone has been given temporary access to act on behalf of another user account.\nThreat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user.\nLegitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.\n","references":["https://developer.okta.com/docs/reference/system-log-query/","https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection","https://support.okta.com/help/s/article/What-is-the-systemoktacom-Account-in-Syslog-Used-For"],"logsource":{"product":"okta","service":"okta"},"tags":["attack.privilege-escalation","attack.defense-impairment","attack.t1484.002","attack.initial-access","attack.t1199"],"path":"rules-placeholder/identity/okta/okta_session_impersonation_granted.yml","techniques":["T1484.002","T1199"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}