{"id":"48739819-8230-4ee3-a8ea-e0289d1fb0ff","title":"Azure Active Directory Hybrid Health AD FS Service Delete","description":"This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.\nA threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.\nThe health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.\n","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"medium","date":"2021-08-26","modified":"2023-10-11","tags":["attack.defense-impairment","attack.t1578.003"],"technique_ids":["T1578.003"],"logsource":{"product":"azure","service":"activitylogs"},"falsepositives":["Legitimate AAD Health AD FS service instances being deleted in a tenant"],"references":["https://o365blog.com/post/hybridhealthagent/"],"source_path":"rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml","source_sha256":"8c66a0976646c02a8ffec0b243b051711e570c7b9811a55a4e1bbc2426851089","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Azure Active Directory Hybrid Health AD FS Service Delete\nid: 48739819-8230-4ee3-a8ea-e0289d1fb0ff\nstatus: test\ndescription: |\n    This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.\n    A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.\n    The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.\nreferences:\n    - https://o365blog.com/post/hybridhealthagent/\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-08-26\nmodified: 2023-10-11\ntags:\n    - attack.defense-impairment\n    - attack.t1578.003\nlogsource:\n    product: azure\n    service: activitylogs\ndetection:\n    selection:\n        CategoryValue: 'Administrative'\n        ResourceProviderValue: 'Microsoft.ADHybridHealthService'\n        ResourceId|contains: 'AdFederationService'\n        OperationNameValue: 'Microsoft.ADHybridHealthService/services/delete'\n    condition: selection\nfalsepositives:\n    - Legitimate AAD Health AD FS service instances being deleted in a tenant\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1578.003","id":"T1578.003","name":"Delete Cloud Instance","page":"techniques/enterprise/T1578.003/"}],"data_path":"data/detection-rules/48739819-8230-4ee3-a8ea-e0289d1fb0ff.json","kind":"sigma"}