Detection rules › By catalog entry

Azure-Microsoft.ADHybridHealthService

Catalog entry	Rules
Microsoft.ADHybridHealthService/services/delete	3
Microsoft.ADHybridHealthService/services/servicemembers/action	4

Microsoft.ADHybridHealthService/services/delete

3 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Azure Active Directory Hybrid Health AD FS Service Delete severity medium T1578,T1578.003

Kusto (2)

Microsoft Entra ID Hybrid Health AD FS Service Delete severity medium T1578,T1578.003
Microsoft Entra ID Hybrid Health AD FS Suspicious Application severity medium T1528,T1550

Microsoft.ADHybridHealthService/services/servicemembers/action

4 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Azure Active Directory Hybrid Health AD FS New Server severity medium T1578

Kusto (3)

Microsoft Entra ID Hybrid Health AD FS New Server severity medium T1578
Microsoft Entra ID Hybrid Health AD FS Suspicious Application severity medium T1528,T1550
NRT Microsoft Entra ID Hybrid Health AD FS New Server severity medium T1578

Back to all Azure-Microsoft.ADHybridHealthService catalog entries