Microsoft 365 Audit: New Federated Domain Added
Alerts on Microsoft 365 audit events indicating a new federated domain was added.
FreeReviewedSigma · Medium · v4
- Product
- m365
- Service
- audit
- Author
- Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule) (SigmaHQ), DRL 1.1
- Published
- 2023-09-18
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Microsoft 365 audit events where the operation indicates adding a new federated domain. Attackers may abuse federated identity to redirect authentication and enable credential misuse or backdoor access through an external identity provider. It relies on audit telemetry from Microsoft 365 that contains an Operation field including both 'domain' and 'add'/'new'.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
microsoft-365-audit-new-federated-domain-added-via-domain-add-operation-58f88172
title: "Microsoft 365 Audit: New Federated Domain Added"
id: 08ab7ad7-6441-44b2-8bf5-334d083a4ccd
related:
- id: 42127bdd-9133-474f-a6f1-97b6c08a4339
type: similar
- id: 58f88172-a73d-442b-94c9-95eaed3cbb36
type: derived
status: test
description: This rule flags Microsoft 365 audit events where the operation indicates adding a new federated domain. Attackers may abuse federated identity to redirect authentication and enable credential misuse or backdoor access through an external identity provider. It relies on audit telemetry from Microsoft 365 that contains an Operation field including both 'domain' and 'add'/'new'.
references:
- https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/
- https://o365blog.com/post/aadbackdoor/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml
author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule), Huntrule Team
date: 2023-09-18
tags:
- attack.privilege-escalation
- attack.defense-impairment
- attack.t1484.002
logsource:
service: audit
product: m365
detection:
selection_domain:
Operation|contains: domain
selection_operation:
Operation|contains:
- add
- new
condition: all of selection_*
falsepositives:
- The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
level: medium
license: DRL-1.1