Exchange Added Federated Domain Successfully via Add-FederatedDomain

Alerts on successful Exchange addition of a new federated domain via Add-FederatedDomain.

FreeUnreviewedSigmamediumv1

exchange-added-federated-domain-successfully-via-add-federateddomain-42127bdd

title: Exchange Added Federated Domain Successfully via Add-FederatedDomain
id: 482daa67-a439-499a-a313-96e2e5ea09d9
related:
  - id: 58f88172-a73d-442b-94c9-95eaed3cbb36
    type: similar
  - id: 42127bdd-9133-474f-a6f1-97b6c08a4339
    type: derived
status: test
description: This rule flags successful creation of a new federated domain in Exchange when the Add-FederatedDomain operation is executed. Adding federation can enable attackers to introduce or manipulate trust relationships for identity federation, potentially supporting credential abuse or backdoored authentication paths. The detection relies on Exchange/M365 audit telemetry capturing eventSource, eventName, and a successful status for Add-FederatedDomain.
references:
  - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
  - https://us-cert.cisa.gov/ncas/alerts/aa21-008a
  - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
  - https://www.sygnia.co/golden-saml-advisory
  - https://o365blog.com/post/aadbackdoor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml
author: Splunk Threat Research Team (original rule), '@ionsor (rule)', Huntrule Team
date: 2022-02-08
tags:
  - attack.persistence
  - attack.t1136.003
logsource:
  service: exchange
  product: m365
detection:
  selection:
    eventSource: Exchange
    eventName: Add-FederatedDomain
    status: success
  condition: selection
falsepositives:
  - The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
level: medium
license: DRL-1.1

What it detects

This rule flags successful creation of a new federated domain in Exchange when the Add-FederatedDomain operation is executed. Adding federation can enable attackers to introduce or manipulate trust relationships for identity federation, potentially supporting credential abuse or backdoored authentication paths. The detection relies on Exchange/M365 audit telemetry capturing eventSource, eventName, and a successful status for Add-FederatedDomain.

Known false positives

The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.