1200kmSECURITY RESEARCH

1200KM / sigma-rule

SAML Token Issuer Anomaly — Sigma Rule

Sigma rule e3393cba-31f0-4207-831e-aef90ab17a8c. SAML Token Issuer Anomaly — Sigma Rule. Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Rule metadata and linked tags

testhighazureriskdetectionattack.t1606attack.credential-access

Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'. Source status: test; severity: high. Source dates: 2023-09-03 / not supplied.

Original logsource
{
  "product": "azure",
  "service": "riskdetection"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 59c9732386a32ee17c66b5511b60516d062c38c17649d99b83ef4d15c4ac5759

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

Original Sigma rule YAML, scroll horizontally if needed
title: SAML Token Issuer Anomaly
id: e3393cba-31f0-4207-831e-aef90ab17a8c
status: test
description: Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
references:
    - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#token-issuer-anomaly
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
date: 2023-09-03
tags:
    - attack.t1606
    - attack.credential-access
logsource:
    product: azure
    service: riskdetection
detection:
    selection:
        riskEventType: 'tokenIssuerAnomaly'
    condition: selection
falsepositives:
    - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high

Original YAML and metadata in JSON

False positives

  • We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.