Detect Audit Policy Modifications with Microsoft 365 Defender

Sun, 26 Sep 2021 20:15:06 +0000

Hello there,

In today’s blog post I want to share with you an advanced hunting query to detect audit policy modifications using Microsoft Defender 365 advanced hunting. Following the MITRE ATT&CK framework this would be T1484.001 Domain Policy Modification: Group Policy Modification.

Microsoft Defender for Endpoint can help us detect audit policy modifications by running the following query:

Detailed information about the audit policy changes is displayed in the AdditionalFields data. Now all we need to do is to translate these values into human readable data.

How to create your Defender ATP Admin Audit Log Dashboard

Sat, 11 Apr 2020 20:11:07 +0000

Hello everyone,

In today’s blogpost I will walk you through the process of creating an admin audit log dashboard for Defender Advanced Threat Protection. During my past customer engagements, I was often asked if there is a way to show device actions taken by Defender ATP admins. The answer is yes, this is possible. First the information is available through the Defender ATP API, second the information is also stored within the Windows event log of the device itself.

Audit on Anything About IT

Detect Audit Policy Modifications with Microsoft 365 Defender

How to create your Defender ATP Admin Audit Log Dashboard