huntrule

Azure Activity Logs: AD Hybrid Health AD FS server instance create/update

Alerts on Administrative Azure Activity Log events adding/updating AD Hybrid Health AD FS service member servers.

FreeReviewedSigma · Medium · v5
Product
azure
Service
activitylogs
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC (SigmaHQ), DRL 1.1
Published
2021-08-26
Updated
2026-07-31
AnalysisDetection
title: "Azure Activity Logs: AD Hybrid Health AD FS server instance create/update"
id: 404be415-f55e-4c8d-b1ab-3b5005e1dfd8
status: test
description: This rule flags Azure Activity Log events in the Administrative category where an AD Hybrid Health AD FS service member (server instance) is created or updated. Such changes can be used to introduce spoofed AD FS signing activity without compromising an on-premises AD FS server. Detection relies on Azure Activity Log telemetry matching the Hybrid Health service resource provider, an AD federation service resource ID, and the specific servicemembers action operation.
references:
  - https://o365blog.com/post/hybridhealthagent/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-08-26
modified: 2023-10-11
tags:
  - attack.defense-impairment
  - attack.t1578
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    CategoryValue: Administrative
    ResourceProviderValue: Microsoft.ADHybridHealthService
    ResourceId|contains: AdFederationService
    OperationNameValue: Microsoft.ADHybridHealthService/services/servicemembers/action
  condition: selection
falsepositives:
  - Legitimate AD FS servers added to an AAD Health AD FS service instance
level: medium
license: DRL-1.1
related:
  - id: 288a39fc-4914-4831-9ada-270e9dc12cb4
    type: derived