Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
102 detections
Filters
Last updated
All Time
Detection languages
45
17
14
12
10
Contributors
51
8
7
7
6
Categories
74
71
56
33
13
Platforms
69
32
30
13
10
Products / Services
52
47
13
12
7
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
3
IDS Protocols
3
This rule detects the addition of a new domain or the modification of federation settings within an Office 365/Azure Active Directory environment. It specifically monitors for operations such as 'Add domain to company', 'Add unverified domain', and 'Set federation settings on domain'. The rule filters against a known list of federated domains to identify new or unexpected federation configurations, which could indicate an adversary attempting to establish persistence or facilitate privilege escalation through trust modification.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling policies, switching them to report-only mode, removing Multi-Factor Authentication (MFA) or grant control requirements, or expanding exclusion lists to exempt users, groups, or locations from security controls. Such modifications are often indicative of an adversary attempting to maintain persistent access or bypass MFA requirements.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling policies, switching them to report-only mode, removing Multi-Factor Authentication (MFA) or grant control requirements, or expanding exclusion lists to exempt users, groups, or locations from security controls. Such modifications are often indicative of an adversary attempting to maintain persistent access or bypass MFA requirements.
Detects modifications to IAM role trust policies (UpdateAssumeRolePolicy) or the creation of new roles (CreateRole) where the Principal is configured with a wildcard or generic open access. This configuration enables any AWS account to assume the role, representing a significant risk for privilege escalation and persistence establishment by attackers.
Detects the creation, update, or activation of an external Identity Provider (IdP) or federated trust configuration within the Okta environment. This activity may indicate an attempt to establish a rogue federation trust, which allows an adversary to perform cross-tenant impersonation and authenticate as any user by minting assertions signed by attacker-controlled keys.
Detects changes to Entra ID (Azure AD) federation settings, specifically targeting updates to trust and authentication parameters such as IssuerUri, ActiveLogOnUri, and TokenSigningCertificate. These modifications are critical indicators of potential Golden SAML attacks, where adversaries forge SAML tokens to bypass MFA and impersonate users.
Detects modifications to Entra ID (Azure AD) cross-tenant access settings, including inbound/outbound trust settings and B2B collaboration configurations. This activity may indicate an adversary attempting to establish persistence or facilitate unauthorized access by creating a trust relationship with an external tenant they control.
Detects modifications to Entra ID (Azure AD) cross-tenant access settings, including inbound/outbound trust settings and B2B collaboration configurations. This activity may indicate an adversary attempting to establish persistence or facilitate unauthorized access by creating a trust relationship with an external tenant they control.
Detects unauthorized changes to the token-signing certificate for federated domains in Microsoft Entra ID (formerly Azure AD). This behavior is often associated with the Golden SAML attack technique, where an adversary modifies federation settings to forge authentication tokens. The rule filters for events occurring outside of standard business hours and alerts when the modification is not performed by known automation service accounts.
Detects unauthorized modifications to federation trust configurations, such as IssuerUri, federationMetadataUrl, or signing certificate thumbprints, on a federated domain. Adversaries may manipulate these settings to establish credential-independent persistence or to forge SAML tokens (Golden SAML) by repointing the federation metadata to attacker-controlled infrastructure.
Detects modifications to the Active Directory Federation Services (AD FS) token-signing certificate on a federated domain. This activity is a critical precursor to Golden SAML attacks, where an attacker replaces the legitimate signing certificate with one they control to forge SAML assertions and bypass authentication mechanisms. The rule excludes modifications initiated by applications identified as federation services.
Detects modifications to AWS IAM trust relationships, specifically the creation or update of SAML providers, OIDC providers, or the update of role trust policies containing wildcard principals. These actions are indicative of an attacker attempting to establish a durable, credential-less persistence mechanism via federated identity manipulation.
Detects the creation of a new AWS IAM role with a trust policy that permits access from an external or wildcard principal, which is often used as a persistence mechanism to allow unauthorized cross-account access. The rule also triggers if an AdministratorAccess policy is attached to a newly created role, as these actions are commonly chained in cloud intrusions.
Detects modifications to AWS IAM role trust policies (UpdateAssumeRolePolicy) that introduce wildcard principals, external AWS account ARNs, or federated identity providers (SAML/OIDC). This behavior is indicative of cross-tenant persistence or backdooring, enabling an adversary to assume privileged roles from an external account without creating local credentials.
Detects anomalous cloud authentication activity where an OIDC provider is created or its thumbprint is updated, followed by an 'AssumeRoleWithWebIdentity' call originating from a GitHub Actions subject claim that does not match authorized repository or branch patterns. This often indicates an adversary abusing OIDC trust relationships to gain unauthorized access to high-privileged roles, frequently linked to subsequent IAM policy modifications like 'setIamPolicy' in GCP to grant persistent 'owner' access.
Detects unauthorized modifications to trust relationships, including Azure AD cross-tenant access policy updates, federation settings, or multi-tenant application credential changes, and GCP Workload/Workforce Identity Federation pool policy updates, when the external entity is not on the approved allow-list.
Detects the addition of a new federated domain or a modification to an existing domain's authentication settings to Federated, where the domain was not previously verified within a standard verification window. This technique is often used by adversaries to establish persistence and perform self-issued token forgery (e.g., SAML/JWT) by trusting an attacker-controlled identity provider.
Detects the addition of a new federated domain or a modification to an existing domain's authentication settings to Federated, where the domain was not previously verified within a standard verification window. This technique is often used by adversaries to establish persistence and perform self-issued token forgery (e.g., SAML/JWT) by trusting an attacker-controlled identity provider.
Detects the creation or modification of federated identity credentials within Azure Active Directory (Entra ID). This technique allows external services like GitHub Actions, Kubernetes, or other identity providers to authenticate as an application without stored secrets, bypassing traditional secret-rotation and credential-scanning security controls. The rule identifies potential unauthorized persistence by highlighting external or unrecognized issuers.
Detects the configuration of cross-tenant access trust policies or cross-tenant synchronization settings within an Azure tenant, specifically where inbound trust for MFA or device compliance/hybrid-join claims is explicitly enabled. This activity may indicate an adversary attempting to establish persistence or facilitate lateral movement by leveraging trusted relationships between partner organizations.
This rule detects modifications to domain federation settings in Azure Active Directory (Microsoft Entra ID), specifically when a domain is set to federated or when critical federation URLs (IssuerUri, ActiveLogOnUri, MetadataExchangeUri) are changed. Such modifications can indicate an attempt to establish malicious domain federation, allowing an adversary to authenticate as any user within the tenant.
Page 2 of 5