Azure SAML Token Issuer Anomaly Risk Event

Flags Azure risk events where a SAML token’s issuer and claims look anomalous or attacker-like.

FreeUnreviewedSigmahighv1

azure-saml-token-issuer-anomaly-risk-event-e3393cba

title: Azure SAML Token Issuer Anomaly Risk Event
id: feb78988-c855-4963-a145-5f77680d682b
status: test
description: This rule flags an Azure risk event of type tokenIssuerAnomaly indicating the SAML token issuer may be compromised. It surfaces sessions where the SAML token’s included claims are unusual or match patterns associated with attacker activity. Detection relies on Azure risk telemetry from the riskdetection service that records riskEventType values for identity-related events.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#token-issuer-anomaly
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_token_issuer_anomaly.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.t1606
  - attack.credential-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: tokenIssuerAnomaly
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: e3393cba-31f0-4207-831e-aef90ab17a8c
    type: derived

What it detects

This rule flags an Azure risk event of type tokenIssuerAnomaly indicating the SAML token issuer may be compromised. It surfaces sessions where the SAML token’s included claims are unusual or match patterns associated with attacker activity. Detection relies on Azure risk telemetry from the riskdetection service that records riskEventType values for identity-related events.

Known false positives

We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.