Azure Active Directory Hybrid Health AD FS New Server

Status: test
Severity: medium
Log source: product azure, service activitylogs
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Source: github.com/SigmaHQ/sigma

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

Known false positives

Legitimate AD FS servers added to an AAD Health AD FS service instance

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1578` Modify Cloud Compute Infrastructure

Telemetry coverage

Platform	Record / event type
Azure	Activity Log event `Microsoft.ADHybridHealthService/services/servicemembers/action`: Creates or updates a server instance in the service.

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: Azure Active Directory Hybrid Health AD FS New Server
id: 288a39fc-4914-4831-9ada-270e9dc12cb4
status: test
description: |
    This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.
    A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
    This can be done programmatically via HTTP requests to Azure.
references:
    - https://o365blog.com/post/hybridhealthagent/
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-08-26
modified: 2023-10-11
tags:
    - attack.defense-impairment
    - attack.t1578
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        CategoryValue: 'Administrative'
        ResourceProviderValue: 'Microsoft.ADHybridHealthService'
        ResourceId|contains: 'AdFederationService'
        OperationNameValue: 'Microsoft.ADHybridHealthService/services/servicemembers/action'
    condition: selection
falsepositives:
    - Legitimate AD FS servers added to an AAD Health AD FS service instance
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    CategoryValue: 'Administrative'
    ResourceProviderValue: 'Microsoft.ADHybridHealthService'
    ResourceId|contains: 'AdFederationService'
    OperationNameValue: 'Microsoft.ADHybridHealthService/services/servicemembers/action'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CategoryValue`	eq	`Administrative`	`field:"CategoryValue" kind:eq value:"Administrative"`
`OperationNameValue`	eq	`Microsoft.ADHybridHealthService/services/servicemembers/action`	`field:"azure_ad::operation_name_value" kind:eq value:"Microsoft.ADHybridHealthService/services/servicemembers/action"`
`ResourceId`	match	`AdFederationService`	`field:"ResourceId" kind:match value:"AdFederationService"`
`ResourceProviderValue`	eq	`Microsoft.ADHybridHealthService`	`field:"ResourceProviderValue" kind:eq value:"Microsoft.ADHybridHealthService"`