{"id":"T1484","name":"Domain or Tenant Policy Modification","url":"https://attack.mitre.org/techniques/T1484","tactics":["defense-impairment","privilege-escalation"],"platforms":["Windows","Identity Provider"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0270","stix_id":"x-mitre-detection-strategy--3eb428c7-5192-4ae2-a5a3-022ca9695ec8","name":"Detection of Domain or Tenant Policy Modifications via AD and Identity Provider","url":"https://attack.mitre.org/detectionstrategies/DET0270","analytics":[{"id":"AN0755","stix_id":"x-mitre-analytic--f403ae40-31ff-4550-b21f-e1c24315276d","name":"Analytic 0755","description":"Adversary modifies Group Policy Objects (GPOs), domain trust, or directory service objects via GUI, CLI, or programmatic APIs. Behavior includes creation/modification of GPOs, delegation permissions, trust objects, or rogue domain controller registration.","url":"https://attack.mitre.org/detectionstrategies/DET0270#AN0755","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=5136","data_component":"DC0066","data_component_name":"Active Directory Object Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ObjectDN","description":"Filter to specific AD containers (e.g., CN=Policies,CN=System,DC=domain,DC=com) for GPOs."},{"field":"AttributeModified","description":"Focus on high-risk attributes such as gPCFileSysPath, ntSecurityDescriptor."},{"field":"TimeWindow","description":"Correlate changes with suspicious process creation or privileged user logon."},{"field":"UserContext","description":"Alert on unexpected user or service account modifying domain policy."}],"live":true,"detection_strategies":["DET0270"],"techniques":["T1484"]},{"id":"AN0756","stix_id":"x-mitre-analytic--65a1926d-e504-4153-b19f-555e8a06e5a5","name":"Analytic 0756","description":"Adversary modifies tenant policy through changes to federation configuration, trust settings, or identity provider additions in Microsoft 365/AzureAD via Portal, PowerShell, or Graph API. Includes setting authentication to federated or updating federated domains.","url":"https://attack.mitre.org/detectionstrategies/DET0270#AN0756","platforms":["Identity Provider"],"log_source_references":[{"name":"m365:unified","channel":"Set federation settings on domain|Set domain authentication|Add federated identity provider","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"},{"name":"azure:signinlogs","channel":"OperationName=SetDomainAuthentication OR Set-FederatedDomain","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"azure-signinlogs"}],"mutable_elements":[{"field":"OperationName","description":"Identify rare modification operations that are not part of standard admin lifecycle."},{"field":"InitiatedBy","description":"Filter by known administrators or service principals. Flag unknown initiators."},{"field":"UserAgent","description":"Detect scripted modifications (e.g., PowerShell/Graph API vs Azure Portal)."},{"field":"TimeWindow","description":"Correlate tenant policy changes with new sign-ins or token forgery attempts."}],"live":true,"detection_strategies":["DET0270"],"techniques":["T1484"]}],"live":true,"version":"1.0","techniques":["T1484"]}],"sigma_rules":[{"id":"9494bff8-959f-4440-bbce-fb87a208d517","title":"Changes to Device Registration Policy","author":"Michael Epping, '@mepples21'","status":"test","level":"high","date":"2022-06-28","modified":null,"description":"Monitor and alert for changes to the device registration policy.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.defense-impairment","attack.t1484"],"path":"rules/cloud/azure/audit_logs/azure_ad_device_registration_policy_changes.yml","techniques":["T1484"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}