MITRE ATT&CK Technique
T1098
1 query tagged with this technique.
View on MITRE ATT&CK →
-
Hunting
Hunt First Time Admin Operation User Baseline
Baselines identities that have ever executed admin operations, then alerts when an account outside that set succeeds — 'the admin who has never administered.'