AN1259
Analytic 1259
Windows
Adversary modifies Active Directory domain trust settings via `netdom`, `nltest`, or PowerShell to add new domain trust or alter federation. Modifications occur in AD object attributes like trustDirection, trustType, trustAttributes, often paired with SeEnableDelegationPrivilege or certificate injection.
WinEventLog:Security
EventCode=5136
WinEventLog:Security
EventCode=4704
WinEventLog:Sysmon
EventCode=1
[ObjectType]
Focus on `trustedDomain` or `foreignSecurityPrincipal` AD objects in trust containers.
[AttributeModified]
Monitor attributes like `trustPartner`, `trustDirection`, `trustType`, `msDS-TrustForestTrustInfo`.
[TimeWindow]
Correlate trust creation with unusual logon events or certificate modifications.
[UserContext]
Flag rare accounts or non-standard admin users performing trust changes.
AN1260
Analytic 1260
Identity Provider
Adversary adds federated identity provider (IdP) or modifies tenant domain authentication from Managed to Federated. Detected via API, PowerShell, or Admin Portal through federation events like `Set domain authentication`, `Add federated identity provider`, or `Update-MsolFederatedDomain`.
m365:unified
Set federation settings on domain|Set domain authentication|Add federated identity provider
azure:signinlogs
OperationName=SetDomainAuthentication OR Update-MsolFederatedDomain
[OperationName]
Identify rare trust-modification operations (SetDomainAuthentication, Update-MsolFederatedDomain).
[InitiatedBy]
Flag federated trust changes performed by unknown users, service principals, or tokens.
[UserAgent]
Separate scripted/API interactions from GUI-based administrative changes.
[TimeWindow]
Correlate trust change to federated login or SAML token injection within short window.