Windows Security: Access to Azure AD Health Monitoring Agent Registry Key
Flags suspicious access to the Azure AD Health Monitoring Agent registry key using Windows Security 4656/4663.
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC (SigmaHQ), DRL 1.1
- Published
- 2021-08-26
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows security events where a process accesses a specific registry key for the Azure AD Health monitoring agent. It focuses on key access events and filters out known Microsoft Identity Health monitoring agent executables. Unexpected access to this registry location may indicate tampering with monitoring components or discovery of related configuration. The detection relies on Security events 4656 and 4663 telemetry, including object type/name and the initiating process name.
Reporting behind it
- o365blog.comhttps://o365blog.com/post/hybridhealthagent/
- github.comhttps://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: Access to Azure AD Health Monitoring Agent Registry Key"
id: 03bde968-0097-468d-bac9-c7b251d034a1
status: test
description: This rule identifies Windows security events where a process accesses a specific registry key for the Azure AD Health monitoring agent. It focuses on key access events and filters out known Microsoft Identity Health monitoring agent executables. Unexpected access to this registry location may indicate tampering with monitoring components or discovery of related configuration. The detection relies on Security events 4656 and 4663 telemetry, including object type/name and the initiating process name.
references:
- https://o365blog.com/post/hybridhealthagent/
- https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-08-26
modified: 2022-10-09
tags:
- attack.discovery
- attack.t1012
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4656
- 4663
ObjectType: Key
ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent
filter:
ProcessName|contains:
- Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe
- Microsoft.Identity.Health.Adfs.InsightsService.exe
- Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe
- Microsoft.Identity.Health.Adfs.PshSurrogate.exe
- Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe
condition: selection and not filter
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: ff151c33-45fa-475d-af4f-c2f93571f4fe
type: derived