A New Trust Was Created To A Domain
Addition of domains is seldom and should be verified for legitimacy.
Sigma rule (View on GitHub)
1title: A New Trust Was Created To A Domain
2id: 0255a820-e564-4e40-af2b-6ac61160335c
3status: stable
4description: Addition of domains is seldom and should be verified for legitimacy.
5references:
6 - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4706
7author: Thomas Patzke
8date: 2019/12/03
9modified: 2024/01/16
10tags:
11 - attack.persistence
12 - attack.t1098
13logsource:
14 product: windows
15 service: security
16detection:
17 selection:
18 EventID: 4706
19 condition: selection
20falsepositives:
21 - Legitimate extension of domain structure
22level: medium
References
Related rules
- User Added to Local Administrator Group
- GCP Access Policy Deleted
- Bulk Deletion Changes To Privileged Account Permissions
- Privileged User Has Been Created
- AWS IAM Backdoor Users Keys