Azure AD Hybrid Health AD FS: New/Updated Service Member Server via Administrative Activity Logs

Alerts on Administrative Azure Activity Log events adding/updating AD Hybrid Health AD FS service member servers.

FreeUnreviewedSigmamediumv1

azure-ad-hybrid-health-ad-fs-new-updated-service-member-server-via-administrativ-288a39fc

title: "Azure AD Hybrid Health AD FS: New/Updated Service Member Server via Administrative Activity Logs"
id: 404be415-f55e-4c8d-b1ab-3b5005e1dfd8
status: test
description: This rule flags Azure AD Hybrid Health AD FS events where a server instance (service member) is created or updated within an AD Hybrid health service. Attackers may abuse this by adding a fraudulent server entry intended to spoof AD FS-related signing logs, without needing to compromise an on-prem AD FS server. The detection relies on Azure Activity Logs for Administrative-category entries for the Microsoft.ADHybridHealthService resource provider and specific service member action operations.
references:
  - https://o365blog.com/post/hybridhealthagent/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-08-26
modified: 2023-10-11
tags:
  - attack.defense-impairment
  - attack.t1578
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    CategoryValue: Administrative
    ResourceProviderValue: Microsoft.ADHybridHealthService
    ResourceId|contains: AdFederationService
    OperationNameValue: Microsoft.ADHybridHealthService/services/servicemembers/action
  condition: selection
falsepositives:
  - Legitimate AD FS servers added to an AAD Health AD FS service instance
level: medium
license: DRL-1.1
related:
  - id: 288a39fc-4914-4831-9ada-270e9dc12cb4
    type: derived

What it detects

This rule flags Azure AD Hybrid Health AD FS events where a server instance (service member) is created or updated within an AD Hybrid health service. Attackers may abuse this by adding a fraudulent server entry intended to spoof AD FS-related signing logs, without needing to compromise an on-prem AD FS server. The detection relies on Azure Activity Logs for Administrative-category entries for the Microsoft.ADHybridHealthService resource provider and specific service member action operations.

Known false positives

Legitimate AD FS servers added to an AAD Health AD FS service instance

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.