Analytics BIOC
Informational
✕
Device Registration Policy modification
An identity changed the Device Registration policy.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- AzureAD Audit Log
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Abuse Elevation Control Mechanism (T1548)
Attacker's goals:
An attacker attempts to change Active Directory configuration for persistence or defense evasion. With a modified Device Registration policy, an attacker might be able to access the tenant without possible blockage for later access.
Investigative actions:
Check what policy has been changed. Check whether the user changing the configuration is permitted to perform such actions.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- A user modified the Device Registration Policy for the first time Low (parent: Informational)