Skip to content

Hide Navigation Hide TOC

Change to Authentication Method (4d78a000-ab52-4564-88a5-7ab5242b20c7)

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Cluster A Galaxy A Cluster B Galaxy B Level
Change to Authentication Method (4d78a000-ab52-4564-88a5-7ab5242b20c7) Sigma-Rules Modify Authentication Process - T1556 (f4c1826f-a322-41cd-9557-562100848c84) Attack Pattern 1
Change to Authentication Method (4d78a000-ab52-4564-88a5-7ab5242b20c7) Sigma-Rules Account Manipulation - T1098 (a10641f4-87b4-45a3-a906-92a149cb2c27) Attack Pattern 1