LoFP / legit administrative pim setting configuration changes

Techniques

• t1078
• t1078.004

Sample rules

Changes To PIM Settings

• source: sigma
• technicques:
  • t1078
  • t1078.004

Description

Detects when changes are made to PIM roles

Detection logic

condition: selection
selection:
  properties.message: Update role setting in PIM