huntrule

Azure AD Hybrid Health AD FS Service Deletion via Azure Activity Logs

Flags Azure AD Hybrid Health AD FS service deletions from Azure Activity Logs under the Administrative category.

FreeReviewedSigma · Medium · v5
Product
azure
Service
activitylogs
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC (SigmaHQ), DRL 1.1
Published
2021-08-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags deletion operations for Azure AD Hybrid Health AD FS service instances in a tenant by matching Azure Activity Logs administrative events. Attackers can abuse this component lifecycle to remove or disrupt health AD FS artifacts used for monitoring and signing log spoofing scenarios. The detection relies on Azure activity log fields indicating the Administrative category, the Microsoft.ADHybridHealthService provider, the AD Federation service resource identifier, and the specific services/delete operation name.

Reporting behind it

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.