TA0004 · PRIVILEGE ESCALATION
Trust Modification
Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not…
Detect it with
Monitor for modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain or updates domain authentication from Managed to Federated via ActionTypes Set federation settings on domain and Set domain authentication .
Why it matters on shift
Trust Modification is one of the concrete ways adversaries achieve privilege escalation. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After privilege escalation, the next tactic is usually Defense Evasion. Search your telemetry for the transition before closing the ticket.
Kill-chain context