HUNT 22 Federation Domain Trust Changes

Query

// Hunt     : Hunt - Federation & Domain Trust Changes (Golden SAML / Persistence) (30d)
// Tactics  : Persistence, PrivilegeEscalation, DefenseEvasion
// MITRE    : T1484.002 (Domain Trust Modification), T1556
// Purpose  : Detects changes to Entra ID federation / domain authentication settings. Adding
//            or modifying a federated domain (or issuer/token-signing config) lets an attacker
//            forge SAML tokens for ANY user ("Golden SAML" — Midnight Blizzard / NOBELIUM).
//            These events are rare and almost always high-signal. Review EVERY hit against a
//            known change ticket. No threshold — this is a review-all timeline.
//==========================================================================================

let FederationOps = dynamic([
    "Set federation settings on domain",
    "Set domain authentication",
    "Update domain",
    "Add unverified domain",
    "Add verified domain",
    "Verify domain",
    "Verify email verified domain",
    "Add partner to cross-tenant access setting",
    "Update a partner cross-tenant access setting",
    "Update federation settings"
]);
AuditLogs
| where TimeGenerated > ago(30d)
| where LoggedByService in~ ("Core Directory", "AAD Cloud Sync", "Authentication Methods")
| where OperationName in~ (FederationOps)
| where Result =~ "success"
| extend Initiator = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend InitiatorIP = tostring(InitiatedBy.user.ipAddress)
| extend TargetDomain = tostring(TargetResources[0].displayName)
| extend ModifiedProps = tostring(TargetResources[0].modifiedProperties)
| project TimeGenerated, OperationName, Initiator, InitiatorIP, TargetDomain, ModifiedProps, Result, CorrelationId
| order by TimeGenerated desc

Explanation

This query is designed to detect changes to federation and domain authentication settings in Entra ID (formerly known as Azure Active Directory) over the past 30 days. These changes can be indicative of a security threat, such as the "Golden SAML" attack, where attackers forge SAML tokens to impersonate any user.

Here's a simple breakdown of what the query does:

Define Operations of Interest: It lists specific operations related to federation and domain settings that are of interest, such as setting federation settings, adding or verifying domains, and updating cross-tenant access settings.
Filter Audit Logs: It searches through audit logs from the last 30 days, focusing on logs generated by specific services like "Core Directory," "AAD Cloud Sync," and "Authentication Methods."
Check for Successful Operations: It filters the logs to only include operations that were successful.
Extract Relevant Information: For each log entry that matches the criteria, it extracts details such as:
- The time the operation was performed.
- The type of operation.
- The initiator of the operation (either a user or an application).
- The IP address of the initiator.
- The target domain that was affected.
- Any properties that were modified.
- The result of the operation.
- A correlation ID for tracking.
Sort by Time: Finally, it orders the results by the time the operation was generated, showing the most recent changes first.

The purpose of this query is to identify and review every instance of these rare and potentially high-risk changes to ensure they are legitimate and authorized, as they could indicate a security breach if not.