Azure Active Directory Hybrid Health AD FS Service Delete

Status: test
Severity: medium
Log source: product azure, service activitylogs
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Source: github.com/SigmaHQ/sigma

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

Known false positives

Legitimate AAD Health AD FS service instances being deleted in a tenant

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1578.003` Modify Cloud Compute Infrastructure: Delete Cloud Instance

Telemetry coverage

Platform	Record / event type
Azure	Activity Log event `Microsoft.ADHybridHealthService/services/delete`: Deletes a service instance in the tenant.

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: Azure Active Directory Hybrid Health AD FS Service Delete
id: 48739819-8230-4ee3-a8ea-e0289d1fb0ff
status: test
description: |
    This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.
    A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
    The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
references:
    - https://o365blog.com/post/hybridhealthagent/
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-08-26
modified: 2023-10-11
tags:
    - attack.defense-impairment
    - attack.t1578.003
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        CategoryValue: 'Administrative'
        ResourceProviderValue: 'Microsoft.ADHybridHealthService'
        ResourceId|contains: 'AdFederationService'
        OperationNameValue: 'Microsoft.ADHybridHealthService/services/delete'
    condition: selection
falsepositives:
    - Legitimate AAD Health AD FS service instances being deleted in a tenant
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    CategoryValue: 'Administrative'
    ResourceProviderValue: 'Microsoft.ADHybridHealthService'
    ResourceId|contains: 'AdFederationService'
    OperationNameValue: 'Microsoft.ADHybridHealthService/services/delete'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CategoryValue`	eq	`Administrative`	`field:"CategoryValue" kind:eq value:"Administrative"`
`OperationNameValue`	eq	`Microsoft.ADHybridHealthService/services/delete`	`field:"azure_ad::operation_name_value" kind:eq value:"Microsoft.ADHybridHealthService/services/delete"`
`ResourceId`	match	`AdFederationService`	`field:"ResourceId" kind:match value:"AdFederationService"`
`ResourceProviderValue`	eq	`Microsoft.ADHybridHealthService`	`field:"ResourceProviderValue" kind:eq value:"Microsoft.ADHybridHealthService"`