Azure AD Federation Trust Modified
Detects modifications to Azure AD federation settings or domain authentication methods. Such changes can be indicative of a Golden SAML attack, where an attacker establishes a new federation trust to forge SAML tokens and gain unauthorized access.
Microsoft Sentinel (KQL)
