Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1484

Domain or Tenant Policy Modification

Windows · Identity Provider1 piece on this siteT1484 on attack.mitre.org

Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

First-hour playbookMembers

Domain-level access you cannot account for

An unexplained Domain Admin, directory replication by something that is not a domain controller, or a ticket that does not match any authentication.

T1484.001

how MITRE says to see it

Detection of Domain or Tenant Policy Modifications via AD and Identity Provider

  • Adversary modifies Group Policy Objects (GPOs), domain trust, or directory service objects via GUI, CLI, or programmatic APIs. Behavior includes creation/modification of GPOs, delegation permissions, trust objects, or rogue domain controller registration.
  • Adversary modifies tenant policy through changes to federation configuration, trust settings, or identity provider additions in Microsoft 365/AzureAD via Portal, PowerShell, or Graph API. Includes setting authentication to federated or updating federated domains.

what reduces it

  • M1018 User Account Management. Consider implementing WMI and security filtering to further tailor which users and computers a GPO will apply to.
  • M1026 Privileged Account Management. Use least privilege and protect administrative access to the Domain Controller and Active Directory Federation Services (AD FS) server. Do not create service accounts with administrative privileges.
  • M1047 Audit. Identify and correct GPO permissions abuse opportunities (ex: GPO modification privileges) using auditing tools such as BloodHound (version 1.5.1 and later).

sub-techniques

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.