Azure Domain Federation Settings Modified

 1title: Azure Domain Federation Settings Modified
 2id: 352a54e1-74ba-4929-9d47-8193d67aba1e
 3status: test
 4description: Identifies when an user or application modified the federation settings on the domain.
 5references:
 6    - https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes
 7author: Austin Songer
 8date: 2021-09-06
 9modified: 2022-06-08
10tags:
11    - attack.privilege-escalation
12    - attack.persistence
13    - attack.defense-evasion
14    - attack.initial-access
15    - attack.t1078
16logsource:
17    product: azure
18    service: auditlogs
19detection:
20    selection:
21        ActivityDisplayName: Set federation settings on domain
22    condition: selection
23falsepositives:
24    - Federation Settings being modified or deleted may be performed by a system administrator.
25    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
26    - Federation Settings modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
27
28level: medium