Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
93
25
23
19
11
Contributors
98
20
18
9
5
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
134
60
56
24
6
Products / Services
94
57
57
24
12
MITRE Techniques
103
56
55
31
30
IDS Classtypes
1
1
IDS Protocols
3
Detects unauthorized modifications to federation trust configurations, such as IssuerUri, federationMetadataUrl, or signing certificate thumbprints, on a federated domain. Adversaries may manipulate these settings to establish credential-independent persistence or to forge SAML tokens (Golden SAML) by repointing the federation metadata to attacker-controlled infrastructure.
Detects modifications to the Active Directory Federation Services (AD FS) token-signing certificate on a federated domain. This activity is a critical precursor to Golden SAML attacks, where an attacker replaces the legitimate signing certificate with one they control to forge SAML assertions and bypass authentication mechanisms. The rule excludes modifications initiated by applications identified as federation services.
Detects anomalous cross-account AssumeRole activities, including chained role assumptions, which are often used by cloud-native intrusion sets to launder access, evade single-account logging detection, and move laterally across AWS environments. The rule identifies AssumeRole events targeting non-allowlisted accounts or sequences where credentials are immediately used to perform further cross-account assumptions.
Detects modifications to AWS IAM trust relationships, specifically the creation or update of SAML providers, OIDC providers, or the update of role trust policies containing wildcard principals. These actions are indicative of an attacker attempting to establish a durable, credential-less persistence mechanism via federated identity manipulation.
Detects modifications to AWS IAM role trust policies (UpdateAssumeRolePolicy) that introduce wildcard principals, external AWS account ARNs, or federated identity providers (SAML/OIDC). This behavior is indicative of cross-tenant persistence or backdooring, enabling an adversary to assume privileged roles from an external account without creating local credentials.
Detects successful AWS STS AssumeRole, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity calls originating from an AWS account ID not included in the 'trusted_aws_accounts' lookup. The rule further enriches events with geolocation and ASN data to flag potential cross-account activity from high-risk or unexpected regions.
Detects anomalous cloud authentication activity where an OIDC provider is created or its thumbprint is updated, followed by an 'AssumeRoleWithWebIdentity' call originating from a GitHub Actions subject claim that does not match authorized repository or branch patterns. This often indicates an adversary abusing OIDC trust relationships to gain unauthorized access to high-privileged roles, frequently linked to subsequent IAM policy modifications like 'setIamPolicy' in GCP to grant persistent 'owner' access.
Detects unauthorized modifications to trust relationships, including Azure AD cross-tenant access policy updates, federation settings, or multi-tenant application credential changes, and GCP Workload/Workforce Identity Federation pool policy updates, when the external entity is not on the approved allow-list.
Detects changes to federation settings on an Entra ID domain, including modifications to IssuerUri, ActiveLogOnUri, MetadataExchangeUri, or SigningCertificate, as well as transitions between Managed and Federated authentication types. Such changes can facilitate 'Golden SAML' attacks by allowing an adversary to forge authentication tokens for the tenant.
Detects the addition of a new federated domain or a modification to an existing domain's authentication settings to Federated, where the domain was not previously verified within a standard verification window. This technique is often used by adversaries to establish persistence and perform self-issued token forgery (e.g., SAML/JWT) by trusting an attacker-controlled identity provider.
Detects changes to federation settings on an Entra ID domain, including modifications to IssuerUri, ActiveLogOnUri, MetadataExchangeUri, or SigningCertificate, as well as transitions between Managed and Federated authentication types. Such changes can facilitate 'Golden SAML' attacks by allowing an adversary to forge authentication tokens for the tenant.
Detects the addition of a new federated domain or a modification to an existing domain's authentication settings to Federated, where the domain was not previously verified within a standard verification window. This technique is often used by adversaries to establish persistence and perform self-issued token forgery (e.g., SAML/JWT) by trusting an attacker-controlled identity provider.
Detects changes to federation settings on an Entra ID domain, including modifications to IssuerUri, ActiveLogOnUri, MetadataExchangeUri, or SigningCertificate, as well as transitions between Managed and Federated authentication types. Such changes can facilitate 'Golden SAML' attacks by allowing an adversary to forge authentication tokens for the tenant.
Detects changes to federation settings on an Entra ID domain, including modifications to IssuerUri, ActiveLogOnUri, MetadataExchangeUri, or SigningCertificate, as well as transitions between Managed and Federated authentication types. Such changes can facilitate 'Golden SAML' attacks by allowing an adversary to forge authentication tokens for the tenant.
Detects the creation or modification of federated identity credentials within Azure Active Directory (Entra ID). This technique allows external services like GitHub Actions, Kubernetes, or other identity providers to authenticate as an application without stored secrets, bypassing traditional secret-rotation and credential-scanning security controls. The rule identifies potential unauthorized persistence by highlighting external or unrecognized issuers.
Detects the configuration of cross-tenant access trust policies or cross-tenant synchronization settings within an Azure tenant, specifically where inbound trust for MFA or device compliance/hybrid-join claims is explicitly enabled. This activity may indicate an adversary attempting to establish persistence or facilitate lateral movement by leveraging trusted relationships between partner organizations.
This rule detects modifications to domain federation settings in Azure Active Directory (Microsoft Entra ID), specifically when a domain is set to federated or when critical federation URLs (IssuerUri, ActiveLogOnUri, MetadataExchangeUri) are changed. Such modifications can indicate an attempt to establish malicious domain federation, allowing an adversary to authenticate as any user within the tenant.
This rule detects modifications to domain federation settings in Azure Active Directory (Microsoft Entra ID), specifically when a domain is set to federated or when critical federation URLs (IssuerUri, ActiveLogOnUri, MetadataExchangeUri) are changed. Such modifications can indicate an attempt to establish malicious domain federation, allowing an adversary to authenticate as any user within the tenant.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings. This rule alerts on changes that allow external tenants to interact with the environment, such as enabling inbound/outbound trusts, automatic redemption, or trusting MFA claims, which can be leveraged to establish persistence or facilitate lateral movement between tenants.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings. This rule alerts on changes that allow external tenants to interact with the environment, such as enabling inbound/outbound trusts, automatic redemption, or trusting MFA claims, which can be leveraged to establish persistence or facilitate lateral movement between tenants.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings. This rule alerts on changes that allow external tenants to interact with the environment, such as enabling inbound/outbound trusts, automatic redemption, or trusting MFA claims, which can be leveraged to establish persistence or facilitate lateral movement between tenants.
Page 3 of 9