Azure Active Directory Hybrid Health AD FS New Server

testmedium
Log-Quelle: azure · activitylogsAutor Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTICDatum 2021-08-26
01

Beschreibung

Was dies ist, in Kürze.

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

02

Tags

attack.defense-impairmentattack.t1578
03

Regelquelle (YAML)

title: Azure Active Directory Hybrid Health AD FS New Server
id: 288a39fc-4914-4831-9ada-270e9dc12cb4
status: test
description: |
    This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.
    A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
    This can be done programmatically via HTTP requests to Azure.
references:
    - https://web.archive.org/web/20220619212736/https://o365blog.com/post/hybridhealthagent/
    - https://aadinternals.com/talks/HelSec%20August%202021.pdf
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/identity#microsoftadhybridhealthservice
    - https://www.inversecos.com/2023/01/detecting-fake-events-in-azure-sign-in.html
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-08-26
modified: 2026-10-21
tags:
    - attack.defense-impairment
    - attack.t1578
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        category: 'Administrative'
        resourceId|contains: 'AdFederationService'
        operationName: 'MICROSOFT.ADHYBRIDHEALTHSERVICE/SERVICES/SERVICEMEMBERS/ACTION'
    condition: selection
falsepositives:
    - Legitimate AD FS servers added to an AAD Health AD FS service instance
level: medium
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.