Detection rules › By event

Azure-Microsoft.ADHybridHealthService

Event	Rules
Microsoft.ADHybridHealthService/services/delete	3
Microsoft.ADHybridHealthService/services/servicemembers/action	4

Microsoft.ADHybridHealthService/services/delete

3 detection rules reference this event. View event page.

Sigma (1)

Azure Active Directory Hybrid Health AD FS Service Delete severity medium T1578, T1578.003

Kusto (2)

Microsoft Entra ID Hybrid Health AD FS Service Delete severity medium T1578, T1578.003
Microsoft Entra ID Hybrid Health AD FS Suspicious Application severity medium T1528, T1550

Microsoft.ADHybridHealthService/services/servicemembers/action

4 detection rules reference this event. View event page.

Sigma (1)

Azure Active Directory Hybrid Health AD FS New Server severity medium T1578

Kusto (3)

Microsoft Entra ID Hybrid Health AD FS New Server severity medium T1578
Microsoft Entra ID Hybrid Health AD FS Suspicious Application severity medium T1528, T1550
NRT Microsoft Entra ID Hybrid Health AD FS New Server severity medium T1578