Suspicious New Federated Domain Added - Exchange (via exchange)

title: Suspicious New Federated Domain Added - Exchange (via exchange)
id: 2acc5134-b515-5362-842d-1bcf8a27128a
status: stable
description: This rule detects the addition of a new Federated Domain.
references:
    - https://attack.mitre.org/techniques/T1136/003/
    - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
    - https://us-cert.cisa.gov/ncas/alerts/aa21-008a
    - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
    - https://www.sygnia.co/golden-saml-advisory
    - https://o365blog.com/post/aadbackdoor/
author: Huntrule Team
date: 2026-04-03
tags:
    - attack.persistence
    - attack.t1136.003
logsource:
    service: exchange
    product: m365
detection:
    selection:
        eventSource: Exchange
        eventName: 'Add-FederatedDomain'
        status: success
    condition: selection
falsepositives:
    - Unknown
level: medium