Azure AD Hybrid Health AD FS Service Deletion via Azure Activity Logs
Flags Azure AD Hybrid Health AD FS service deletions from Azure Activity Logs under the Administrative category.
- Product
- azure
- Service
- activitylogs
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC (SigmaHQ), DRL 1.1
- Published
- 2021-08-26
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags deletion operations for Azure AD Hybrid Health AD FS service instances in a tenant by matching Azure Activity Logs administrative events. Attackers can abuse this component lifecycle to remove or disrupt health AD FS artifacts used for monitoring and signing log spoofing scenarios. The detection relies on Azure activity log fields indicating the Administrative category, the Microsoft.ADHybridHealthService provider, the AD Federation service resource identifier, and the specific services/delete operation name.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Azure AD Hybrid Health AD FS Service Deletion via Azure Activity Logs
id: fa599507-3676-4111-9d6d-96c4bc985303
status: test
description: This rule flags deletion operations for Azure AD Hybrid Health AD FS service instances in a tenant by matching Azure Activity Logs administrative events. Attackers can abuse this component lifecycle to remove or disrupt health AD FS artifacts used for monitoring and signing log spoofing scenarios. The detection relies on Azure activity log fields indicating the Administrative category, the Microsoft.ADHybridHealthService provider, the AD Federation service resource identifier, and the specific services/delete operation name.
references:
- https://o365blog.com/post/hybridhealthagent/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-08-26
modified: 2023-10-11
tags:
- attack.defense-impairment
- attack.t1578.003
logsource:
product: azure
service: activitylogs
detection:
selection:
CategoryValue: Administrative
ResourceProviderValue: Microsoft.ADHybridHealthService
ResourceId|contains: AdFederationService
OperationNameValue: Microsoft.ADHybridHealthService/services/delete
condition: selection
falsepositives:
- Legitimate AAD Health AD FS service instances being deleted in a tenant
level: medium
license: DRL-1.1
related:
- id: 48739819-8230-4ee3-a8ea-e0289d1fb0ff
type: derived