SAML Token Issuer Anomaly

Rule Info

Name

SAML Token Issuer Anomaly

Author

Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'

Description

Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Reference

https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#token-issuer-anomaly

Date

2023-09-03 00:00:00

Modified

None

e3393cba-31f0-4207-831e-aef90ab17a8c

Rule History

Author

Title

Date

Commit

Nasreddine Bencherchali

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12

598d29f81

Ryan Plas

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02

1d40f1d20

github-actions[bot]

Merge PR #4891 from @nasbench - Promote older rules status from `experimental` to `test`

2024-07-01

47085e948

Mark Morowczynski

Merge PR #4423 from @MarkMorow - Add Azure AD Identity Protection Rules

2023-09-06

efe2c9bbc

frack113

Change field name in detection

2023-08-10

450b619c1

Nasreddine Bencherchali

chore: change service name to lowercase

2023-08-08

67d0d2aff

frack113

Fix to pass the tests

2023-08-08

a66b38d3d

Mark Morowczynski

Update azure_identity_protectection_anomalous_token.yml

2023-08-07

fa780ec7b

Mark Morowczynski

Create azure_identity_protectection_anomalous_token.yml

2023-08-07

ef2d8b4c9