Detectionmediumstable

A New Trust Was Created To A Domain

Addition of domains is seldom and should be verified for legitimacy.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Thomas PatzkeCreated Tue Dec 03Updated Tue Jan 160255a820-e564-4e40-af2b-6ac61160335cwindows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Detection Logic

detection:
    selection:
        EventID: 4706
    condition: selection

False Positives

Legitimate extension of domain structure

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

0255a820-e564-4e40-af2b-6ac61160335c

Status

stable

Level

medium

Type

Detection

Created

Tue Dec 03

Modified

Tue Jan 16

Author

Path

rules/windows/builtin/security/win_security_susp_add_domain_trust.yml

Raw Tags

attack.privilege-escalationattack.persistenceattack.t1098