Azure Activity Logs: Deletion of Azure AD Hybrid Health AD FS Service

Flags Azure AD Hybrid Health AD FS service deletions from Azure Activity Logs under the Administrative category.

FreeUnreviewedSigmamediumv1

azure-activity-logs-deletion-of-azure-ad-hybrid-health-ad-fs-service-48739819

title: "Azure Activity Logs: Deletion of Azure AD Hybrid Health AD FS Service"
id: fa599507-3676-4111-9d6d-96c4bc985303
status: test
description: This rule identifies an Azure AD Hybrid Health AD FS service instance being deleted within a tenant by matching Administrative activity log events. Attackers may misuse the service lifecycle by creating and later removing such components, potentially to disrupt or cover tracks related to AD FS signing log activity. The detection relies on Azure Activity Log telemetry, specifically Administrative category entries with the Microsoft.ADHybridHealthService provider and a delete operation for AD Federation service resources.
references:
  - https://o365blog.com/post/hybridhealthagent/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-08-26
modified: 2023-10-11
tags:
  - attack.defense-impairment
  - attack.t1578.003
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    CategoryValue: Administrative
    ResourceProviderValue: Microsoft.ADHybridHealthService
    ResourceId|contains: AdFederationService
    OperationNameValue: Microsoft.ADHybridHealthService/services/delete
  condition: selection
falsepositives:
  - Legitimate AAD Health AD FS service instances being deleted in a tenant
level: medium
license: DRL-1.1
related:
  - id: 48739819-8230-4ee3-a8ea-e0289d1fb0ff
    type: derived

What it detects

This rule identifies an Azure AD Hybrid Health AD FS service instance being deleted within a tenant by matching Administrative activity log events. Attackers may misuse the service lifecycle by creating and later removing such components, potentially to disrupt or cover tracks related to AD FS signing log activity. The detection relies on Azure Activity Log telemetry, specifically Administrative category entries with the Microsoft.ADHybridHealthService provider and a delete operation for AD Federation service resources.

Known false positives

Legitimate AAD Health AD FS service instances being deleted in a tenant

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.