| DET0096 |
Account Manipulation Behavior Chain Detection |
T1098 |
| DET0283 |
Behavior-chain detection for T1134 Access Token Manipulation on Windows |
T1134 |
| DET0456 |
Behavior-chain detection for T1134.002 Create Process with Token (Windows) |
T1134.002 |
| DET0136 |
Behavior-chain detection for T1134.005 Access Token Manipulation: SID-History Injection (Windows) |
T1134.005 |
| DET0030 |
Detect Conditional Access Policy Modification in Identity and Cloud Platforms |
T1556.009 |
| DET0293 |
Detect Hybrid Identity Authentication Process Modification |
T1556.007 |
| DET0190 |
Detect MFA Modification or Disabling Across Platforms |
T1556.006 |
| DET0589 |
Detect Modification of Authentication Process via Reversible Encryption |
T1556.005 |
| DET0270 |
Detection of Domain or Tenant Policy Modifications via AD and Identity Provider |
T1484 |
| DET0305 |
Detection of Group Policy Modifications via AD Object Changes and File Activity |
T1484.001 |
| DET0458 |
Detection of Trust Relationship Modifications in Domain or Tenant Policies |
T1484.002 |
| DET0531 |
Detection Strategy for Additional Cloud Credentials in IaaS/IdP/SaaS |
T1098.001 |
| DET0539 |
Detection Strategy for Cloud Application Integration |
T1671 |
| DET0276 |
Detection Strategy for Rogue Domain Controller (DCShadow) Registration and Replication Abuse |
T1207 |
| DET0240 |
Detection Strategy for Steal or Forge Authentication Certificates |
T1649 |
| DET0299 |
Multi-Platform File and Directory Permissions Modification Detection Strategy |
T1222 |
| DET0418 |
Windows DACL Manipulation Behavioral Chain Detection Strategy |
T1222.001 |