SAML Token Issuer Anomaly

Status: test
Severity: high
Log source: product azure, service riskdetection
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Source: github.com/SigmaHQ/sigma

Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Known false positives

We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1606` Forge Web Credentials

Rule body

title: SAML Token Issuer Anomaly
id: e3393cba-31f0-4207-831e-aef90ab17a8c
status: test
description: Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
references:
    - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#token-issuer-anomaly
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
date: 2023-09-03
tags:
    - attack.t1606
    - attack.credential-access
logsource:
    product: azure
    service: riskdetection
detection:
    selection:
        riskEventType: 'tokenIssuerAnomaly'
    condition: selection
falsepositives:
    - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    riskEventType: 'tokenIssuerAnomaly'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`riskEventType`	eq	`tokenIssuerAnomaly`	`field:"azure_ad::risk_event_types" kind:eq value:"tokenIssuerAnomaly"`