Sunturai
Back to results
MediumSigmaHQRoberto Rodriguez (Cyb3rWard0g) +2

Azure Active Directory Hybrid Health AD FS New Server

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS…

Description

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

Detection logic

Detection requirements

Platform
IaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
azure
Log source service
activitylogs

Known benign triggers

  • Legitimate AD FS servers added to an AAD Health AD FS service instance

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice