Sigma rule: Azure Active Directory Hybrid Health AD FS New Server

Rule

Title

Azure Active Directory Hybrid Health AD FS New Server

Status

test

Level

medium

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC

Date

2021-08-26

Modified

2026-10-21

File

rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.
A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
This can be done programmatically via HTTP requests to Azure.

Log source

product

azure

service

activitylogs

Detection

selection:
    category: 'Administrative'
    resourceId|contains: 'AdFederationService'
    operationName: 'MICROSOFT.ADHYBRIDHEALTHSERVICE/SERVICES/SERVICEMEMBERS/ACTION'
condition: selection

False positives (as the rule lists them)

• Legitimate AD FS servers added to an AAD Health AD FS service instance

Tags

• attack.defense-impairment
• attack.t1578

MITRE ATT&CK ids this rule names

• T1578

References

• https://web.archive.org/web/20220619212736/https://o365blog.com/post/hybridhealthagent/
• https://aadinternals.com/talks/HelSec%20August%202021.pdf
• https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/identity#microsoftadhybridhealthservice
• https://www.inversecos.com/2023/01/detecting-fake-events-in-azure-sign-in.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml