Hunt MSOL Azure AD Connect / Entra Sync servers

Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

Microsoft announced that starting from April 30 2025, Microsoft Entra Connect will need to have the minimal version of 2.4.18.0. If you want to identitify if you still have an AD Connect or Entra Sync server with a lower version, you can use below KQL query.

References

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceTvmSoftwareInventory` action `any`: Installed software inventory

Rule body

DeviceTvmSoftwareInventory
| where SoftwareVendor == "microsoft"
| where SoftwareName in ("microsoft_entra_connect_sync", "microsoft_azure_ad_connect")
| distinct DeviceName, SoftwareName, SoftwareVendor, SoftwareVersion
| extend MSOnlineDepricationSafe = iff(
    parse_version(SoftwareVersion) < parse_version("2.4.18.0"),
    "No",
    "Yes"
)

Stages and Predicates

Stage 1: `source`

DeviceTvmSoftwareInventory

Stage 2: `where`

| where SoftwareVendor == "microsoft"

Stage 3: `where`

| where SoftwareName in ("microsoft_entra_connect_sync", "microsoft_azure_ad_connect")

Stage 4: `distinct`

| distinct DeviceName, SoftwareName, SoftwareVendor, SoftwareVersion

Stage 5: `extend`

| extend MSOnlineDepricationSafe = iff(
    parse_version(SoftwareVersion) < parse_version("2.4.18.0"),
    "No",
    "Yes"
)

MSOnlineDepricationSafe =

if/* macro: (parse_version(SoftwareVersion) < parse_version("2.4.18.0")) */"No"

else"Yes"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`SoftwareName`	in	`microsoft_azure_ad_connect` `microsoft_entra_connect_sync`	`field:"SoftwareName" kind:in`
`SoftwareVendor`	eq	`microsoft`	`field:"SoftwareVendor" kind:eq value:"microsoft"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`MSOnlineDepricationSafe`	`extend`