ADFSDomainTrustMods[Nobelium]

Description

This query will find when federation trust settings are changed for a domain or when the domain is changed from managed to federated authentication. Results will relate to when a new Active Directory Federated Service (ADFS) TrustedRealm object, such as a signing certificate, is added. Modification to domain federation settings should be rare, so confirm the added or modified target domain/URL is legitimate administrative behavior. The actor, Nobelium, was observed modifying domain trust settings to subvert existing mechanisms and cause the domain to accept authorization tokens signed with actor-owned certificates. See Customer Guidance on Recent Nation-State Cyber Attacks. To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see Update or repair the settings of a federated domain in Office 365, Azure, or Intune. For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: 3.2.5.1.2.4 Security Realm Data. For further information on AuditLogs, please see Microsoft Entra ID audit activity reference. This query is inspired by an Azure Sentinal detection. References: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365 https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml

Query · kql

let auditLookback = 1d;
(union isfuzzy=true 
    (
    CloudAppEvents
    | where Timestamp > ago(auditLookback)
    | where ActionType =~ "Set federation settings on domain."
    ),
    (
    CloudAppEvents
    | where Timestamp > ago(auditLookback)
    | where ActionType =~ "Set domain authentication."
    | extend modifiedProperties = parse_json(RawEventData).ModifiedProperties
    | mvexpand modifiedProperties
    | extend newDomainValue=tostring(parse_json(modifiedProperties).NewValue)
    | where newDomainValue has "Federated"
    )
)
| extend resultStatus = extractjson("$.ResultStatus", tostring(RawEventData), typeof(string))
| extend targetDisplayName = parse_json(RawEventData).Target[0].ID
| project Timestamp, ActionType, InitiatingUserOrApp=AccountDisplayName, targetDisplayName, resultStatus, InitiatingIPAddress=IPAddress, UserAgent
Raw source ADFSDomainTrustMods[Nobelium] · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 8b55db72-9ece-4e93-b551-cd7eb7355104
name: ADFSDomainTrustMods[Nobelium]
description: |
  This query will find when federation trust settings are changed for a domain or when the domain is changed from managed to federated authentication. Results will relate to when a new Active Directory Federated Service (ADFS) TrustedRealm object, such as a signing certificate, is added.
  Modification to domain federation settings should be rare, so confirm the added or modified target domain/URL is legitimate administrative behavior.
  The actor, Nobelium, was observed modifying domain trust settings to subvert existing mechanisms and cause the domain to accept authorization tokens signed with actor-owned certificates. See Customer Guidance on Recent Nation-State Cyber Attacks.
  To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see Update or repair the settings of a federated domain in Office 365, Azure, or Intune.
  For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: 3.2.5.1.2.4 Security Realm Data.
  For further information on AuditLogs, please see Microsoft Entra ID audit activity reference.
  This query is inspired by an Azure Sentinal detection.
  References:
  https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
  https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365
  https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b
  https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities
  https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- Defense evasion
tags:
- Nobelium
query: |
  let auditLookback = 1d;
  (union isfuzzy=true 
      (
      CloudAppEvents
      | where Timestamp > ago(auditLookback)
      | where ActionType =~ "Set federation settings on domain."
      ),
      (
      CloudAppEvents
      | where Timestamp > ago(auditLookback)
      | where ActionType =~ "Set domain authentication."
      | extend modifiedProperties = parse_json(RawEventData).ModifiedProperties
      | mvexpand modifiedProperties
      | extend newDomainValue=tostring(parse_json(modifiedProperties).NewValue)
      | where newDomainValue has "Federated"
      )
  )
  | extend resultStatus = extractjson("$.ResultStatus", tostring(RawEventData), typeof(string))
  | extend targetDisplayName = parse_json(RawEventData).Target[0].ID
  | project Timestamp, ActionType, InitiatingUserOrApp=AccountDisplayName, targetDisplayName, resultStatus, InitiatingIPAddress=IPAddress, UserAgent

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.