Domain Trust Modification - Unauthorized Active Directory Trust Change
Detects modifications to domain trust relationships, such as the creation of a new trust, removal of an existing trust, or changes to trusted domain information. Such events are monitored as they can indicate an adversary attempting to elevate privileges or establish persistence across a forest or multi-domain environment.
Microsoft Sentinel (KQL)
