Microsoft 365 Audit: New Federated Domain Added via Domain Add Operation

Alerts on Microsoft 365 audit events indicating a new federated domain was added.

FreeUnreviewedSigmamediumv1

microsoft-365-audit-new-federated-domain-added-via-domain-add-operation-58f88172

title: "Microsoft 365 Audit: New Federated Domain Added via Domain Add Operation"
id: 08ab7ad7-6441-44b2-8bf5-334d083a4ccd
related:
  - id: 42127bdd-9133-474f-a6f1-97b6c08a4339
    type: similar
  - id: 58f88172-a73d-442b-94c9-95eaed3cbb36
    type: derived
status: test
description: This rule flags Microsoft 365 audit events where the operation indicates adding a new federated domain. Attackers may abuse federated identity relationships to persist access or enable credential-based activity through a third-party identity source. It relies on audit telemetry from the Microsoft 365 (M365) service, matching audit event fields that contain 'domain' along with operation terms for 'add' and 'new'.
references:
  - https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/
  - https://o365blog.com/post/aadbackdoor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml
author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule), Huntrule Team
date: 2023-09-18
tags:
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1484.002
logsource:
  service: audit
  product: m365
detection:
  selection_domain:
    Operation|contains: domain
  selection_operation:
    Operation|contains:
      - add
      - new
  condition: all of selection_*
falsepositives:
  - The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
level: medium
license: DRL-1.1

What it detects

This rule flags Microsoft 365 audit events where the operation indicates adding a new federated domain. Attackers may abuse federated identity relationships to persist access or enable credential-based activity through a third-party identity source. It relies on audit telemetry from the Microsoft 365 (M365) service, matching audit event fields that contain 'domain' along with operation terms for 'add' and 'new'.

Known false positives

The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.