Microsoft 365 - Modification of Trusted Domain

azure

Classification:

attack

Tactic:

TA0006-credential-access

Set up the azure integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detects when a user creates or modifies a trusted domain object in Microsoft 365.

Strategy

Monitor Azure AD Audit logs for the following @evt.name:

  • Set federation settings on domain
  • Set domain authentication

Monitor Microsoft 365 Audit logs for the following @evt.name:

  • Set federation settings on domain.
  • Set domain authentication.

An attacker can create a new attacker-controlled domain as federated or modify the existing federation settings for a domain by configuring a new, secondary signing certificate. Both of these techniques would allow the attacker to authenticate as any user bypassing authentication requirements like a valid password or MFA.

Triage and response

  1. Determine if {{@usr.id}} should have made a {{@evt.name}} API call.
  2. If the API call was not made by the user:
    • Remove the suspicious domain or settings.
    • Begin your organization’s Incident Response (IR) process.
  3. If the API call was made by the user:
    • Ensure the change was authorized.