Suspicious New Federated Domain Added (via audit)

title: Suspicious New Federated Domain Added (via audit)
id: 884d1d69-6644-5c09-bd75-efd526152d6c
status: stable
description: This rule detects the addition of a new Federated Domain.
references:
    - https://attack.mitre.org/techniques/T1484/002/
    - https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/
    - https://o365blog.com/post/aadbackdoor/
author: Huntrule Team
date: 2026-07-11
tags:
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1484.002
logsource:
    service: audit
    product: m365
detection:
    selection_domain:
        Operation|contains: 'domain'
    selection_operation:
        Operation|contains:
            - 'add'
            - 'new'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium