ATT&CK technique
View on MITRE ATT&CK →
T1484.002
Trust Modification
Defense ImpairmentPrivilege Escalation
13 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Entra ID Federated Identity Credential Modified | production | 2026-10-01 |
| elastic | AWS IAM SAML Provider Updated | production | 2026-09-18 |
| elastic | Domain Added to Google Workspace Trusted Domains | production | 2026-09-18 |
| elastic | M365 Exchange Federated Domain Created or Modified | production | 2026-09-18 |
| elastic | Attempt to Deactivate an Okta Network Zone | production | 2026-09-18 |
| elastic | New Okta Identity Provider (IdP) Added by Admin | production | 2026-09-18 |
| elastic | AWS IAM OIDC Provider Created by Rare User | production | 2026-09-18 |
| elastic | AWS IAM SAML Provider Created | production | 2026-09-18 |
| elastic | Entra ID Domain Federation Configuration Change | production | 2026-09-18 |
| splunk | Azure AD New Federated Domain Added | production | 2026-05-13 |
| splunk | O365 Cross-Tenant Access Change | production | 2026-05-13 |
| splunk | Azure AD New Custom Domain Added | production | 2026-05-13 |
| sigma | New Federated Domain Added | test | 2023-09-18 |