Domain or Tenant Policy Modification

Technique · ATTACK:enterprise:T1484

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1484",
  "title": "Domain or Tenant Policy Modification",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1484",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--ebb42bbe-62d7-47d7-a55f-3b08b61d792d",
  "external_id": "T1484",
  "domain": "enterprise",
  "created": "2019-03-07T14:10:32.650Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "4.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "ADSecurity GPO Persistence 2016",
      "url": "https://adsecurity.org/?p=2716"
    },
    {
      "source_name": "Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks",
      "url": "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"
    },
    {
      "source_name": "Okta Cross-Tenant Impersonation 2023",
      "url": "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection"
    },
    {
      "source_name": "Wald0 Guide to GPOs",
      "url": "https://wald0.com/?p=179"
    },
    {
      "source_name": "Harmj0y Abusing GPO Permissions",
      "url": "https://blog.harmj0y.net/redteaming/abusing-gpo-permissions/"
    }
  ]
}

Explicit source assertions (5)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.