t1484 | LoFP

t1484

Title	Tags
false positives will most likely be present based on risk scoring and how the organization handles system to system communication. filter, or modify as needed. in addition to count by analytics, adding a risk score may be useful. in our testing, with 22 events over 30 days, the risk scores ranged from 500 to 80,000. your organization will be different, monitor and modify as needed.	t1210 t1484 endpoint splunk
general usage of group policy will trigger this detection, also please not gpos modified using tools such as sharpgpoabuse will not generate the ad audit events which enable this detection.	t1222 t1222.001 t1484 t1484.001 endpoint splunk
group policy objects are created as part of regular administrative operations, filter as needed.	t1078.002 t1484 t1484.001 endpoint splunk
in most organizations, domain federation settings will be updated infrequently. filter as needed.	t1484 T1484.002 azure active directory splunk
in most organizations, new customm domains will be updated infrequently. filter as needed.	t1484 T1484.002 azure active directory splunk
legitimate administrative activity	t1484 t1547 windows elastic
legitimate execution by system administrators.	t1484 t1484.001 t1547 windows sigma
legitimate use	t1005 t1040 t1059 t1072 t1090 t1124 t1127 t1219 t1484 t1484.001 t1546 t1546.015 t1555 t1555.003 t1562 t1562.001 windows sigma
none.	t1078 t1078.004 t1207 t1222 t1222.001 t1484 endpoint aws instance splunk
saml provider could be updated by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. saml provider updates by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1484 aws elastic
the default group policy objects within an ad network may be legitimately updated for administrative operations, filter as needed.	t1484 t1484.001 endpoint splunk
users allowed to perform these modifications (user found in field subjectusername)	t1484 t1484.001 windows sigma
when a gpo is manually edited and 5136 events are not logging to splunk.	t1222 t1222.001 t1484 t1484.001 endpoint splunk
when there is a change to ntsecuritydescriptor, windows logs the entire acl with the newly added components. if existing accounts are present with this permission, they will raise an alert each time the ntsecuritydescriptor is updated unless whitelisted.	t1484 endpoint splunk