T1484.002 — Trust Modification

Tactics: Defense Impairment, Privilege Escalation · Platforms: Identity Provider, Windows

Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow…

Sub-technique of Domain or Tenant Policy Modification (T1484).

Sigma detection rules (2)

title: "T1484.002 Domain or Tenant Policy Modification: Trust Modification"
id: 97656068-a285-4197-81f3-eed5d6beaf5e
description: 'Detection of Trust Relationship Modifications in Domain or Tenant Policies via Windows Security auditing of domain trust creation and modification events. (Data Component: Trust Modification; baseline tier: windows-eventid.) Tune using: ObjectType, AttributeModified, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1484/002
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.defense-impairment
  - attack.privilege-escalation
  - attack.t1484.002

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID:
      - 4706
      - 4716

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate domain/tenant administrators creating or modifying trust relationships during planned AD forest or tenant restructuring; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

title: "T1484.002 Domain or Tenant Policy Modification: Trust Modification"
id: c3451247-39c9-4680-9d68-70a46b74690f
description: 'Detection of Trust Relationship Modifications in Domain or Tenant Policies. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: OperationName, InitiatedBy, UserAgent, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1484/002
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.defense-impairment
  - attack.privilege-escalation
  - attack.t1484.002

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Set-FederationTrust'
      - 'Update-FederationTrust'
      - 'Set-MsolDomainFederationSettings'

  condition: selection

falsepositives:
  - Routine ADFS or federation certificate rollover performed by identity administrators.

level: high

Related sub-techniques

• T1484.001 Group Policy Modification

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1484.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan