Windows Security Event Registry Access to Azure AD Health Agent Keys

title: Windows Security Event Registry Access to Azure AD Health Agent Keys
id: 67a44c49-e372-41c3-99fb-4a00f6f9ddec
status: test
description: This rule identifies suspicious Windows security events where a process accesses registry keys under HKLM\SOFTWARE\Microsoft\ADHealthAgent. It focuses on Event IDs 4656 (handle requested) and 4663 (registry value changed/accessed) for key objects in the MACHINE hive, which can indicate tampering or probing of Azure AD Health service agent configuration. The detection relies on Windows Security auditing telemetry for registry object access and filters out known Microsoft.Identity.Health agent executables by process name.
references:
  - https://o365blog.com/post/hybridhealthagent/
  - https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_service_agent.yml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-08-26
modified: 2022-10-09
tags:
  - attack.discovery
  - attack.t1012
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4656
      - 4663
    ObjectType: Key
    ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\ADHealthAgent
  filter:
    ProcessName|contains:
      - Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe
      - Microsoft.Identity.Health.Adfs.InsightsService.exe
      - Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe
      - Microsoft.Identity.Health.Adfs.PshSurrogate.exe
      - Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1d2ab8ac-1a01-423b-9c39-001510eae8e8
    type: derived