Azure Active Directory Hybrid Health AD FS Service Delete

testmedium
Log-Quelle: azure · activitylogsAutor Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTICDatum 2021-08-26
01

Beschreibung

Was dies ist, in Kürze.

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

02

Tags

attack.defense-impairmentattack.t1578.003
03

Regelquelle (YAML)

title: Azure Active Directory Hybrid Health AD FS Service Delete
id: 48739819-8230-4ee3-a8ea-e0289d1fb0ff
status: test
description: |
    This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.
    A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
    The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
references:
    - https://web.archive.org/web/20220619212736/https://o365blog.com/post/hybridhealthagent/
    - https://aadinternals.com/talks/HelSec%20August%202021.pdf
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/identity#microsoftadhybridhealthservice
    - https://www.inversecos.com/2023/01/detecting-fake-events-in-azure-sign-in.html
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-08-26
modified: 2026-10-21
tags:
    - attack.defense-impairment
    - attack.t1578.003
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        category: 'Administrative'
        resourceId|contains: 'AdFederationService'
        operationName: 'MICROSOFT.ADHYBRIDHEALTHSERVICE/SERVICES/DELETE'
    condition: selection
falsepositives:
    - Legitimate AAD Health AD FS service instances being deleted in a tenant
level: medium
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.