Windows Security Event Detection: Access to Azure AD Health Monitoring Agent Registry Key

title: "Windows Security Event Detection: Access to Azure AD Health Monitoring Agent Registry Key"
id: 03bde968-0097-468d-bac9-c7b251d034a1
status: test
description: This rule identifies Windows security events where registry key access is attempted for HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent. Such activity can indicate attempts to tamper with or inspect Azure AD health monitoring components, which may be leveraged for persistence, discovery, or evasion. It relies on Security Event 4656 and 4663 telemetry with registry object type and name matching, while excluding expected processes associated with the monitoring agent.
references:
  - https://o365blog.com/post/hybridhealthagent/
  - https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-08-26
modified: 2022-10-09
tags:
  - attack.discovery
  - attack.t1012
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4656
      - 4663
    ObjectType: Key
    ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent
  filter:
    ProcessName|contains:
      - Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe
      - Microsoft.Identity.Health.Adfs.InsightsService.exe
      - Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe
      - Microsoft.Identity.Health.Adfs.PshSurrogate.exe
      - Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ff151c33-45fa-475d-af4f-c2f93571f4fe
    type: derived