LoFP / legitimate extension of domain structure

Techniques

• t1098

Sample rules

A New Trust Was Created To A Domain

• source: sigma
• technicques:
  • t1098

Description

Addition of domains is seldom and should be verified for legitimacy.

Detection logic

condition: selection
selection:
  EventID: 4706