Domain or Tenant Policy Modification detection rulesT1484

Monitor and alert for changes to the device registration policy.

azure

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

windows

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

windows · process_creation

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

windows · ps_script

Detects the addition of a new Federated Domain.

m365

Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session. This event type "user.session.impersonation.grant" signifies that someone has been given temporary access to act on behalf of another user account. Threat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user. Legitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.

okta

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

windows

Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.

windows

Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.

windows · process_creation