Azure Active Directory Hybrid Health AD FS Service Delete

calendar Oct 21, 2026 · attack.defense-impairment attack.t1578.003  ·
Share on: linkedin copy

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

Sigma rule (View on GitHub)

 1title: Azure Active Directory Hybrid Health AD FS Service Delete
 2id: 48739819-8230-4ee3-a8ea-e0289d1fb0ff
 3status: test
 4description: |
 5    This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.
 6    A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
 7    The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.    
 8references:
 9    - https://web.archive.org/web/20220619212736/https://o365blog.com/post/hybridhealthagent/
10    - https://aadinternals.com/talks/HelSec%20August%202021.pdf
11    - https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/identity#microsoftadhybridhealthservice
12    - https://www.inversecos.com/2023/01/detecting-fake-events-in-azure-sign-in.html
13author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
14date: 2021-08-26
15modified: 2026-10-21
16tags:
17    - attack.defense-impairment
18    - attack.t1578.003
19logsource:
20    product: azure
21    service: activitylogs
22detection:
23    selection:
24        category: 'Administrative'
25        resourceId|contains: 'AdFederationService'
26        operationName: 'MICROSOFT.ADHYBRIDHEALTHSERVICE/SERVICES/DELETE'
27    condition: selection
28falsepositives:
29    - Legitimate AAD Health AD FS service instances being deleted in a tenant
30level: medium

References

  • Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agent

    Azure AD Connect Health is a feature that allows viewing the health of on-prem hybrid infrastructure components, including Azure AD Connect and AD FS servers. Health information is gathered by agents installed on each on-prem hybrid server. Since March 2021, also AD FS sign-in events are gathered and sent to Azure AD. In this write-up (based on a Threat Analysis report by Secureworks), I’ll explain how anyone with a local administrator access to AD FS server (or proxy), can create arbitrary sign-ins events to Azure AD sign-ins log. Moreover, I’ll show how Global Administrators can register fake agents to Azure AD - even for tenants not using AD FS at all.


    Read More

  • ÑÝ+ ;/^³jÕ³Ï>»víÚÍ›7oݺ•89™ÁîV˜¬�¬Î­Ï`xÅú yIïQQqÅ/S‚ôR÷UÛyu·W±¶.ÕgŠäYyØ.Z4�G6Má«6}@#ya–­ j�íõï½>ý@r]ê¸ãPöbgCb^I­\·ì©_¤A—„èù1‰ô72 J„ì%ªf{/Q>âŠD‰¸{$ËÙ¬¡ó¶ÍÒB;ja í‹1‹«ã“¶4’/d²...


    Read More

  • Azure permissions for Identity - Azure RBAC

    Lists the permissions for the Azure resource providers in the Identity category.


    Read More

  • Detecting Fake Events in Azure Sign-in Logs

    For more background and details on how these attacks are possible please refer to @DrAzureAD and @Secureworks write-up as they cover this in extensive detail. METHOD 1: Hijacking ADFS to register f...


    Read More

Related rules

to-top