mdecrevoisier high experimental sigma

Active Directory federated trust added

Detects scenarios where an federated trust is added by an attacker.

View Source

Detection Logic

{
  "selection": {
    "Operation": "Set domain authentication.",
    "ModifiedProperties.NewValue
| contains": "federated"
  },
  "condition": "selection"
}

False Positives

  • ⚠ New federated trust added

Field Validations

Loading…

Comments (0)

Loading comments...