Sunturai
Back to results
MediumSigmaHQSplunk Threat Research Team (original rule) +1

New Federated Domain Added

Detects the addition of a new Federated Domain.

Detection logic

Detection requirements

Platform
Identity ProviderWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
m365
Log source service
audit

Known benign triggers

  • The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice