Azure Domain Federation Settings Modified

 1title: Azure Domain Federation Settings Modified
 2id: 352a54e1-74ba-4929-9d47-8193d67aba1e
 3status: test
 4description: Identifies when an user or application modified the federation settings on the domain.
 5references:
 6    - https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes
 7author: Austin Songer
 8date: 2021/09/06
 9modified: 2022/06/08
10tags:
11    - attack.initial_access
12    - attack.t1078
13logsource:
14    product: azure
15    service: auditlogs
16detection:
17    selection:
18        ActivityDisplayName: Set federation settings on domain
19    condition: selection
20falsepositives:
21    - Federation Settings being modified or deleted may be performed by a system administrator.
22    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
23    - Federation Settings modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
24
25level: medium