Azure Active Directory Hybrid Health AD FS New Server

calendar Oct 21, 2026 · attack.defense-impairment attack.t1578  ·
Share on: linkedin copy

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

Sigma rule (View on GitHub)

 1title: Azure Active Directory Hybrid Health AD FS New Server
 2id: 288a39fc-4914-4831-9ada-270e9dc12cb4
 3status: test
 4description: |
 5    This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.
 6    A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
 7    This can be done programmatically via HTTP requests to Azure.    
 8references:
 9    - https://web.archive.org/web/20220619212736/https://o365blog.com/post/hybridhealthagent/
10    - https://aadinternals.com/talks/HelSec%20August%202021.pdf
11    - https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/identity#microsoftadhybridhealthservice
12    - https://www.inversecos.com/2023/01/detecting-fake-events-in-azure-sign-in.html
13author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
14date: 2021-08-26
15modified: 2026-10-21
16tags:
17    - attack.defense-impairment
18    - attack.t1578
19logsource:
20    product: azure
21    service: activitylogs
22detection:
23    selection:
24        category: 'Administrative'
25        resourceId|contains: 'AdFederationService'
26        operationName: 'MICROSOFT.ADHYBRIDHEALTHSERVICE/SERVICES/SERVICEMEMBERS/ACTION'
27    condition: selection
28falsepositives:
29    - Legitimate AD FS servers added to an AAD Health AD FS service instance
30level: medium

References

  • Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agent

    Azure AD Connect Health is a feature that allows viewing the health of on-prem hybrid infrastructure components, including Azure AD Connect and AD FS servers. Health information is gathered by agents installed on each on-prem hybrid server. Since March 2021, also AD FS sign-in events are gathered and sent to Azure AD. In this write-up (based on a Threat Analysis report by Secureworks), I’ll explain how anyone with a local administrator access to AD FS server (or proxy), can create arbitrary sign-ins events to Azure AD sign-ins log. Moreover, I’ll show how Global Administrators can register fake agents to Azure AD - even for tenants not using AD FS at all.


    Read More

  • ÑÝ+ ;/^³jÕ³Ï>»víÚÍ›7oݺ•89™ÁîV˜¬�¬Î­Ï`xÅú yIïQQqÅ/S‚ôR÷UÛyu·W±¶.ÕgŠäYyØ.Z4�G6Má«6}@#ya–­ j�íõï½>ý@r]ê¸ãPöbgCb^I­\·ì©_¤A—„èù1‰ô72 J„ì%ªf{/Q>âŠD‰¸{$ËÙ¬¡ó¶ÍÒB;ja í‹1‹«ã“¶4’/d²...


    Read More

  • Azure permissions for Identity - Azure RBAC

    Lists the permissions for the Azure resource providers in the Identity category.


    Read More

  • Detecting Fake Events in Azure Sign-in Logs

    For more background and details on how these attacks are possible please refer to @DrAzureAD and @Secureworks write-up as they cover this in extensive detail. METHOD 1: Hijacking ADFS to register f...


    Read More

Related rules

to-top