Analytics BIOC Low

Azure domain federation settings modification attempt

A user or application attempted to modify the federation settings of the domain.

Module:
Identity Threat Detection (ITDR), SaaS Threat Detection
Licensed by:
Identity Threat Detection (ITDR)
Data source:
AzureAD Audit Log
ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004)
ATT&CK techniques: Account Manipulation: Additional Cloud Credentials (T1098.001) Domain or Tenant Policy Modification (T1484)
Attacker's goals:

An attacker attempts to change Active Directory configuration for persistence or defense evasion.

Investigative actions:

Check what configuration has been changed. Check whether the user changing the configuration is permitted.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • A successful Azure domain federation settings modification Medium (parent: Low)