<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-identity-provider-compromise
description: >-
  Detect and investigate identity provider compromises including OAuth/SAML token manipulation, IdP configuration tampering, consent grant abuse, federated trust exploitation, and token signing certificate theft. Covers detection rules for Azure AD, Okta, and ADFS compromise scenarios.
domain: cybersecurity
subdomain: identity-security
tags:
  - IdP-compromise
  - token-manipulation
  - SAML-forgery
  - OAuth-abuse
  - federated-trust
  - consent-phishing
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "DE.CM-1"
  - "DE.CM-3"
  - "DE.AE-1"
  - "DE.AE-3"
  - "RS.AN-1"
  frameworks:
  - "MITRE ATT&CK"
  - "NIST SP 800-63"
  - "CISA Emergency Directives"
  mitre-attack: ["T1606"]
---

# Detecting Identity Provider Compromise

## Overview

Identity provider compromise represents the highest-impact attack vector in modern
environments — a compromised IdP grants access to every connected application.
Detection requires monitoring token issuance anomalies, configuration changes,
consent grants, federation trust modifications, and signing certificate operations.

## Workflow

1. **IdP Configuration Baseline** — Document normal IdP settings, federation trusts, and signing certificates
2. **Token Anomaly Monitoring** — Deploy detection for unusual token lifetimes, claims, and issuance patterns
3. **Admin Activity Auditing** — Monitor all IdP administrative actions with change correlation
4. **Consent Grant Analysis** — Track OAuth application consent grants for excessive or suspicious permissions
5. **Federation Trust Monitoring** — Alert on new or modified trust relationships and SAML configurations
6. **Certificate Operations Tracking** — Monitor signing certificate rotations, exports, and unauthorized access
7. **Cross-IdP Correlation** — Correlate authentication events across federated providers for inconsistencies
8. **Incident Response Preparation** — Maintain IdP-specific IR runbooks with token revocation procedures

## Key Concepts

### IdP Compromise Attack Techniques

| Attack | ATT&CK ID | Target | Indicator |
|--------|----------|--------|-----------|
| Golden SAML | T1606.002 | ADFS | Forged SAML token with stolen signing cert |
| OAuth Token Theft | T1528 | Azure AD/Okta | Unusual token refresh patterns |
| Consent Phishing | T1566 + T1550.001 | Azure AD | Excessive OAuth permission grants |
| IdP Config Tampering | T1556 | Any IdP | Modified authentication policies |
| Federation Trust Abuse | T1484.002 | Azure AD | New trusted domain added |
| MFA Fatigue | T1621 | Any IdP | Repeated push notifications |

### Detection Priority Matrix

| Event | Severity | Detection Latency Target |
|-------|---------|--------------------------|
| New federation trust | Critical | < 5 minutes |
| Signing cert export | Critical | < 5 minutes |
| Global admin creation | Critical | < 15 minutes |
| Conditional Access policy change | High | < 15 minutes |
| Bulk consent grants | High | < 30 minutes |
| Unusual token lifetime | Medium | < 1 hour |
| New OAuth app registration | Medium | < 1 hour |

### Token Validation Checks

| Check | Normal | Anomalous |
|-------|--------|-----------|
| Issuer (iss) | Known IdP URL | Unknown or modified issuer |
| Audience (aud) | Expected application | Unexpected target application |
| Lifetime (exp-iat) | < 1 hour | Multi-day or never-expiring |
| Claims | Role-appropriate | Elevated claims, extra groups |
| Signing Key | Current cert thumbprint | Old or unknown key |

## Detection Opportunities

### Detection Rules

**New Federation Trust (KQL)**:
```
AuditLogs
| where OperationType == "Add"
| where TargetResources has "Domain"
| where Result == "success"
| project TimeGenerated, InitiatedBy, TargetResources
```

**Suspicious OAuth Consent (KQL)**:
```
AuditLogs
| where ActivityDisplayName == "Consent to application"
| extend Permissions = tostring(AdditionalDetails)
| where Permissions has_any ("Mail.Read", "Files.ReadWrite.All", "Directory.ReadWrite.All")
| project TimeGenerated, InitiatedBy, TargetResources, Permissions
```

- **MITRE mapping**: T1606 (Forge Web Credentials), T1528 (Steal Application Access Token), T1556 (Modify Authentication Process)

```yaml
title: Identity Provider Compromise Detection
id: a6b6a5f5-ad1f-400e-afe8-323eefe2538e
status: experimental
description: Detects suspicious activity related to detecting identity provider compromise techniques in identity security context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: high
tags:
  - attack.t1606
  - attack.credential_access
falsepositives:
  - Service account authentication during scheduled batch processing
```

