Detects injection or tampering of DLLs in hybrid identity agents (e.g., AzureADConnectAuthenticationAgentService), registry or configuration changes tied to PTA/AD FS, and anomalous LSASS or AD FS module loads correlated with authentication anomalies.
| Data Component | Name | Channel |
|---|---|---|
| Module Load (DC0016) | WinEventLog:Sysmon | EventCode=7 |
| Active Directory Object Modification (DC0066) | WinEventLog:Directory Service | EventCode=5136 |
| Logon Session Creation (DC0067) | WinEventLog:Security | Anomalous logon without MFA enforcement |
| Field | Description |
|---|---|
| WatchedServices | Hybrid identity services monitored for tampering, e.g., PTA agent, AD FS. |
| TimeWindow | Window correlating DLL/module load events with logon anomalies. |
Detects registration of new PTA agents, conditional access changes disabling hybrid MFA enforcement, or suspicious updates to AD FS token-signing configurations.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | azure:signinlogs | Register PTA Agent or Modify AD FS trust |
| User Account Modification (DC0010) | m365:unified | New agent registration by non-admin user |
| Field | Description |
|---|---|
| PrivilegedRoles | Roles authorized to configure PTA/AD FS integrations. |
Detects API calls registering or updating hybrid identity connectors, modification of cloud-to-on-premises federation trust, and unusual token issuance logs.
| Data Component | Name | Channel |
|---|---|---|
| Cloud Service Modification (DC0069) | CloudTrail:UpdatePolicy | UpdateFederationSettings or RegisterHybridConnector |
| Field | Description |
|---|---|
| MonitoredFederations | Federation trusts and connectors relevant to hybrid identity setup. |
Detects tenant-wide authentication or conditional access changes that weaken hybrid identity enforcement, including disabling AD FS or bypassing hybrid MFA policies.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | m365:unified | Modify Federation Settings or Update Authentication Policy |
| Field | Description |
|---|---|
| PolicyScope | Scope of authentication and federation policies to be monitored. |
Detects suspicious changes to SAML/OAuth federation configurations, such as new signing certificates, altered endpoints, or claims issuance rules granting elevated privileges.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | saas:okta | Federation configuration update or signing certificate change |
| Field | Description |
|---|---|
| FederationEndpoints | Federation/SAML endpoints monitored for modification. |