Detect Audit Policy Modifications with Microsoft 365 Defender

Sun, 26 Sep 2021 20:15:06 +0000

Hello there,

In today’s blog post I want to share with you an advanced hunting query to detect audit policy modifications using Microsoft Defender 365 advanced hunting. Following the MITRE ATT&CK framework this would be T1484.001 Domain Policy Modification: Group Policy Modification.

Microsoft Defender for Endpoint can help us detect audit policy modifications by running the following query:

Detailed information about the audit policy changes is displayed in the AdditionalFields data. Now all we need to do is to translate these values into human readable data.

Advancedhunting on Anything About IT

Detect Audit Policy Modifications with Microsoft 365 Defender