huntrule

Azure Activity Logs: AD Hybrid Health AD FS server instance create/update

Alerts on Administrative Azure Activity Log events adding/updating AD Hybrid Health AD FS service member servers.

FreeReviewedSigma · Medium · v5
Product
azure
Service
activitylogs
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC (SigmaHQ), DRL 1.1
Published
2021-08-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Azure Activity Log events in the Administrative category where an AD Hybrid Health AD FS service member (server instance) is created or updated. Such changes can be used to introduce spoofed AD FS signing activity without compromising an on-premises AD FS server. Detection relies on Azure Activity Log telemetry matching the Hybrid Health service resource provider, an AD federation service resource ID, and the specific servicemembers action operation.

Reporting behind it

Related detections3 linkedT1578 — drag to rearrange
Suspicious AWS EC2 Serial Console Access Enabled via Scattered Spider Technique
Possible Public Bucket IAM Binding for Data Exfiltration (via gcp)
Suspicious GCP Bucket Deletion for Namespace Hijacking (via gcp)
Azure Activity Logs: AD Hybrid Health AD FS server instance create/update
Pivot detection · T1578 · 3 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.