M365 Exchange Add-FederatedDomain Success: New Federated Domain Created
Alerts on successful Exchange addition of a new federated domain via Add-FederatedDomain.
- Product
- m365
- Service
- exchange
- Author
- Splunk Threat Research Team (original rule), '@ionsor (rule)' (SigmaHQ), DRL 1.1
- Published
- 2022-02-08
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies successful creation of a new federated domain in Microsoft 365 via Exchange PowerShell, specifically the Add-FederatedDomain operation. Adding a federated domain can enable authentication redirection or federated identity abuse, which attackers may use to persist access using external identity providers. It relies on Exchange telemetry that records eventSource, eventName, and operation status.
Reporting behind it
- fireeye.comhttps://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- us-cert.cisa.govhttps://us-cert.cisa.gov/ncas/alerts/aa21-008a
- splunk.comhttps://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- sygnia.cohttps://www.sygnia.co/golden-saml-advisory
- o365blog.comhttps://o365blog.com/post/aadbackdoor/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "M365 Exchange Add-FederatedDomain Success: New Federated Domain Created"
id: 482daa67-a439-499a-a313-96e2e5ea09d9
related:
- id: 58f88172-a73d-442b-94c9-95eaed3cbb36
type: similar
- id: 42127bdd-9133-474f-a6f1-97b6c08a4339
type: derived
status: test
description: This rule identifies successful creation of a new federated domain in Microsoft 365 via Exchange PowerShell, specifically the Add-FederatedDomain operation. Adding a federated domain can enable authentication redirection or federated identity abuse, which attackers may use to persist access using external identity providers. It relies on Exchange telemetry that records eventSource, eventName, and operation status.
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.sygnia.co/golden-saml-advisory
- https://o365blog.com/post/aadbackdoor/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml
author: Splunk Threat Research Team (original rule), '@ionsor (rule)', Huntrule Team
date: 2022-02-08
tags:
- attack.persistence
- attack.t1136.003
logsource:
service: exchange
product: m365
detection:
selection:
eventSource: Exchange
eventName: Add-FederatedDomain
status: success
condition: selection
falsepositives:
- The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
level: medium
license: DRL-1.1