Sentinel × Entra ID Audit: Sigma rule library

01 Coverage at a glance

4

Production rules

2

ATT&CK techniques

2

ATT&CK tactics

Sentinel

Output dialect

02 Rule index

Technique	Rule	Severity	Log source
T1078.004	Valid Accounts: Cloud Accounts on Entra ID Audit	medium	Entra ID Audit
T1098	Account Manipulation on Entra ID Audit	medium	Entra ID Audit
T1098	Account Manipulation on Entra ID Audit	medium	Entra ID Audit
T1098	Account Manipulation on Entra ID Audit	medium	Entra ID Audit

03 Example rule

Entra ID Federation Trust Modification, generated by CloudSigma and validated against the Sentinel dialect.

L1 · experimental, tune before deploy verified 2026-04-24 · sha256:ba9dc57a80e54d93 manifest → Verify in CloudSigma →

This rule is currently experimental. CloudSigma generated it from upstream threat intelligence; before enabling in production, tune the falsepositives section in your SIEM against your environment's known automation, service accounts and IP allowlist.

Sigma rule · CloudSigma Sentinel · Entra ID Audit · 2026-04-24

title: Entra ID Federation Trust Modification
id: 0b1c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: >
    Detects modification of federation trust settings in Entra ID.
    Adding or updating a federated identity provider lets the
    attacker mint SAML/OIDC tokens for any user in the tenant — the
    AAD Golden SAML / Magic Web pattern. Earlier versions of this
    rule looked at properties.targetResources[].displayName for
    literal type names, but Entra audit logs expose this signal in
    properties.activityDisplayName instead. The displayName field
    typically carries the actual domain name.
author: CloudSigma
date: 2026-04-24
references:
    - https://attack.mitre.org/techniques/T1078/004/
    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.t1078.004
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.category:
            - DirectoryManagement
            - ApplicationManagement
        properties.result: success
    selection_federation_activity:
        properties.activityDisplayName|contains:
            - Set domain authentication
            - Set federation settings on domain
            - Add identity provider
            - Update identity provider
            - Add unverified domain
    condition: selection and selection_federation_activity
falsepositives:
    - Documented federation configuration with a new partner organization
    - Migration between identity providers under change control
    - Re-verification of a domain after DNS changes
fields:
    - properties.activityDisplayName
    - properties.initiatedBy.user.userPrincipalName
    - properties.initiatedBy.app.displayName
    - properties.targetResources
level: critical

← Back to Sigma library

Sources

Sigma project, https://github.com/SigmaHQ/sigma
Sentinel documentation, https://docs.sentinel.com/

Last verified: 2026-04-24

Sentinel detections for Entra ID Audit