Windows Security: Suspicious Registry Access to ADHealthAgent Health Service Agent Keys
Detects non-standard processes accessing HKLM\SOFTWARE\Microsoft\ADHealthAgent registry key activity in Windows security logs.
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC (SigmaHQ), DRL 1.1
- Published
- 2021-08-26
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows security events where an access attempt targets registry key objects under HKLM:\SOFTWARE\Microsoft\ADHealthAgent, including the key’s values and sub-keys. An attacker could leverage access to AD Health service agent information to support abuse of cloud-connected features such as federation, depending on what the agent exposes. The detection relies on SACL-enabled registry auditing and security events 4656 and 4663, filtering out activity from specific Microsoft.Identity.Health AD FS agent processes.
Reporting behind it
- o365blog.comhttps://o365blog.com/post/hybridhealthagent/
- github.comhttps://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_service_agent.yml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: Suspicious Registry Access to ADHealthAgent Health Service Agent Keys"
id: 67a44c49-e372-41c3-99fb-4a00f6f9ddec
status: test
description: This rule identifies Windows security events where an access attempt targets registry key objects under HKLM:\SOFTWARE\Microsoft\ADHealthAgent, including the key’s values and sub-keys. An attacker could leverage access to AD Health service agent information to support abuse of cloud-connected features such as federation, depending on what the agent exposes. The detection relies on SACL-enabled registry auditing and security events 4656 and 4663, filtering out activity from specific Microsoft.Identity.Health AD FS agent processes.
references:
- https://o365blog.com/post/hybridhealthagent/
- https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_service_agent.yml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-08-26
modified: 2022-10-09
tags:
- attack.discovery
- attack.t1012
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4656
- 4663
ObjectType: Key
ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\ADHealthAgent
filter:
ProcessName|contains:
- Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe
- Microsoft.Identity.Health.Adfs.InsightsService.exe
- Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe
- Microsoft.Identity.Health.Adfs.PshSurrogate.exe
- Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe
condition: selection and not filter
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 1d2ab8ac-1a01-423b-9c39-001510eae8e8
type: derived