Microsoft Entra ID Hybrid Health AD FS Service Delete

Back


Id	86a036b2-3686-42eb-b417-909fc0867771
Rulename	Microsoft Entra ID Hybrid Health AD FS Service Delete
Description	This detection uses AzureActivity logs (Administrative category) to identify the deletion of an Microsoft Entra ID Hybrid Health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is no longer needed via HTTP requests to Azure. More information is available in this blog https://o365blog.com/post/hybridhealthagent/
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1578.003
Required data connectors	AzureActivity
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Activity/Analytic Rules/AADHybridHealthADFSServiceDelete.yaml
Version	2.0.3
Arm template	86a036b2-3686-42eb-b417-909fc0867771.json

KQL

AzureActivity
| where CategoryValue =~ 'Administrative'
| where ResourceProviderValue =~ 'Microsoft.ADHybridHealthService'
| where _ResourceId has 'AdFederationService'
| where OperationNameValue =~ 'Microsoft.ADHybridHealthService/services/delete'
| extend claimsJson = parse_json(Claims)
| extend AppId = tostring(claimsJson.appid), AccountName = tostring(claimsJson.name), Name = tostring(split(Caller,'@',0)[0]), UPNSuffix = tostring(split(Caller,'@',1)[0])
| project-away claimsJson

YAML

tags:
- SimuLand
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: Caller
  - identifier: Name
    columnName: Name
  - identifier: UPNSuffix
    columnName: UPNSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: CallerIpAddress
tactics:
- DefenseEvasion
requiredDataConnectors:
- dataTypes:
  - AzureActivity
  connectorId: AzureActivity
id: 86a036b2-3686-42eb-b417-909fc0867771
severity: Medium
status: Available
query: |
  AzureActivity
  | where CategoryValue =~ 'Administrative'
  | where ResourceProviderValue =~ 'Microsoft.ADHybridHealthService'
  | where _ResourceId has 'AdFederationService'
  | where OperationNameValue =~ 'Microsoft.ADHybridHealthService/services/delete'
  | extend claimsJson = parse_json(Claims)
  | extend AppId = tostring(claimsJson.appid), AccountName = tostring(claimsJson.name), Name = tostring(split(Caller,'@',0)[0]), UPNSuffix = tostring(split(Caller,'@',1)[0])
  | project-away claimsJson  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Activity/Analytic Rules/AADHybridHealthADFSServiceDelete.yaml
kind: Scheduled
queryPeriod: 1d
version: 2.0.3
name: Microsoft Entra ID Hybrid Health AD FS Service Delete
queryFrequency: 1d
triggerThreshold: 0
relevantTechniques:
- T1578.003
description: |
  'This detection uses AzureActivity logs (Administrative category) to identify the deletion of an Microsoft Entra ID Hybrid Health AD FS service instance in a tenant.
  A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
  The health AD FS service can then be deleted after it is no longer needed via HTTP requests to Azure.
  More information is available in this blog https://o365blog.com/post/hybridhealthagent/'  
triggerOperator: gt

ARM