KQL Search

Query Details

HomeAI ToolsDevice Query

HQ 010 Federation Config Changes

Query

// =========================================================================
// HQ-010: Domain Federation / Authentication Configuration Changes
// =========================================================================
// Description : Modifying a domain's authentication type (Managed → 
//               Federated) is the cornerstone of the "Golden SAML" and
//               AADInternals federation abuse attacks. Attackers with 
//               Global Admin privilege can federate a domain with a rogue
//               IDP and forge SAML tokens for any user without knowing
//               their passwords. Any change here is extremely high-fidelity.
// MITRE ATT&CK: TA0003 Persistence
//               T1484.002 – Domain Trust Modification
//               TA0005 Defense Evasion
//               T1606.002 – Forge Web Credentials: SAML Token
// Tools       : AADInternals (ConvertTo-AADIntBackdoor), manual attacker
// Severity    : Critical
// Data Source : AuditLogs (Azure Active Directory)
// =========================================================================

AuditLogs
| where TimeGenerated > ago(90d)
| where ActivityDisplayName in (
    "Set domain authentication",
    "Set federation settings on domain",
    "Set DirSyncEnabled flag",
    "Set Company Information",
    "Set federation settings",
    "Update domain",
    "Verify domain")
| extend InitiatedByUPN  = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatedByApp  = tostring(InitiatedBy.app.displayName)
| extend Actor           = iff(isnotempty(InitiatedByUPN), InitiatedByUPN, InitiatedByApp)
| extend TargetDomain    = tostring(TargetResources[0].displayName)
| extend TargetId        = tostring(TargetResources[0].id)
| mv-expand Prop = TargetResources[0].modifiedProperties
| extend PropName        = tostring(Prop.displayName)
| extend OldValue        = tostring(Prop.oldValue)
| extend NewValue        = tostring(Prop.newValue)
| where Result == "success"
| project
    TimeGenerated,
    Actor,
    ActivityDisplayName,
    TargetDomain,
    TargetId,
    PropName,
    OldValue,
    NewValue,
    LoggedByService,
    CorrelationId
| order by TimeGenerated desc

Explanation

This query is designed to monitor and detect changes in domain authentication settings within Azure Active Directory, specifically focusing on modifications that could indicate a security threat. Here's a simplified breakdown:

  1. Purpose: The query aims to identify changes in domain authentication configurations, which could be exploited in attacks like "Golden SAML" and federation abuse. These changes are critical because they can allow attackers with high-level privileges to manipulate authentication processes and forge credentials.

  2. Data Source: It uses the AuditLogs from Azure Active Directory to track these changes.

  3. Time Frame: The query looks at logs from the past 90 days.

  4. Activities Monitored: It filters for specific activities related to domain authentication and federation settings, such as setting domain authentication, updating federation settings, and verifying domains.

  5. Details Extracted: For each relevant log entry, it extracts details like:

    • The time the change was made (TimeGenerated).
    • Who initiated the change (Actor), whether a user or an application.
    • The specific activity performed (ActivityDisplayName).
    • The domain affected (TargetDomain and TargetId).
    • The properties that were modified, including their old and new values (PropName, OldValue, NewValue).

  6. Filtering: It only considers successful changes (Result == "success").

  7. Output: The results are displayed in descending order of time, showing the most recent changes first.

Overall, this query is a critical security measure to detect unauthorized or suspicious changes in domain authentication settings, which could indicate potential security breaches.

Details

David Alonso profile picture

David Alonso

Released: April 6, 2026

Tables

AuditLogs

Keywords

AuditLogsAzureActiveDirectoryDomainFederationAuthenticationGlobalAdminSAMLTokensUserPasswordsMITREATT&CKPersistenceDefenseEvasionAADInternalsAuditLogsTimeGeneratedActivityDisplayNameInitiatedByUPNInitiatedByAppActorTargetDomainTargetIdPropNameOldValueNewValueResultSuccess

Operators

AuditLogs|where>agoinextendtostringiffisnotemptymv-expandprojectorder bydesc

Actions