CA Policy Updated by Non Approved Actor (50a3c7aa-ec29-44a4-92c1-fce229eef6fc)

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Modify Authentication Process - T1556 (f4c1826f-a322-41cd-9557-562100848c84)	Attack Pattern	CA Policy Updated by Non Approved Actor (50a3c7aa-ec29-44a4-92c1-fce229eef6fc)	Sigma-Rules	1
CA Policy Updated by Non Approved Actor (50a3c7aa-ec29-44a4-92c1-fce229eef6fc)	Sigma-Rules	Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b)	Attack Pattern	1