Azure AD Health Service Agents Registry Keys Access

 1title: Azure AD Health Service Agents Registry Keys Access
 2id: 1d2ab8ac-1a01-423b-9c39-001510eae8e8
 3status: test
 4description: |
 5    This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).
 6    Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).
 7    This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent.
 8    Make sure you set the SACL to propagate to its sub-keys.    
 9references:
10    - https://o365blog.com/post/hybridhealthagent/
11    - https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_service_agent.yml
12author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
13date: 2021-08-26
14modified: 2022-10-09
15tags:
16    - attack.discovery
17    - attack.t1012
18logsource:
19    product: windows
20    service: security
21detection:
22    selection:
23        EventID:
24            - 4656
25            - 4663
26        ObjectType: 'Key'
27        ObjectName: '\REGISTRY\MACHINE\SOFTWARE\Microsoft\ADHealthAgent'
28    filter:
29        ProcessName|contains:
30            - 'Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe'
31            - 'Microsoft.Identity.Health.Adfs.InsightsService.exe'
32            - 'Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe'
33            - 'Microsoft.Identity.Health.Adfs.PshSurrogate.exe'
34            - 'Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe'
35    condition: selection and not filter
36falsepositives:
37    - Unknown
38level: medium

References

• Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agent

  

  Azure AD Connect Health is a feature that allows viewing the health of on-prem hybrid infrastructure components, including Azure AD Connect and AD FS servers. Health information is gathered by agents installed on each on-prem hybrid server. Since March 2021, also AD FS sign-in events are gathered and sent to Azure AD. In this write-up (based on a Threat Analysis report by Secureworks), I’ll explain how anyone with a local administrator access to AD FS server (or proxy), can create arbitrary sign-ins events to Azure AD sign-ins log. Moreover, I’ll show how Global Administrators can register fake agents to Azure AD - even for tenants not using AD FS at all.

  
  Read More

• Set-AuditRule/rules/registry/aad_connect_health_service_agent.yml at c3dec5443414231714d850565d364ca73475ade5 · OTRF/Set-AuditRule

  

  Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity - OTRF/Set-AuditRule

  
  Read More

Related rules

• Azure AD Health Monitoring Agent Registry Keys Access
• HackTool - PCHunter Execution
• Operation Wocao Activity
• Operation Wocao Activity - Security
• Potential Baby Shark Malware Activity