Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1556.007

Hybrid Identity

Defense ImpairmentPersistenceCredential Access 3 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Entra ID Domain Federation Configuration Change production 2026-09-18
elastic New Okta Identity Provider (IdP) Added by Admin production 2026-09-18
elastic Untrusted DLL Loaded by Azure AD Connect Authentication Agent production 2026-09-18