{"id":"ff151c33-45fa-475d-af4f-c2f93571f4fe","title":"Azure AD Health Monitoring Agent Registry Keys Access","description":"This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent.\n","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"medium","date":"2021-08-26","modified":"2022-10-09","tags":["attack.discovery","attack.t1012"],"technique_ids":["T1012"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Unknown"],"references":["https://o365blog.com/post/hybridhealthagent/","https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml"],"source_path":"rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml","source_sha256":"62d903a8722813896742b39e5b81065be8638b2a2a189cb0e4847fe875fe6356","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Azure AD Health Monitoring Agent Registry Keys Access\nid: ff151c33-45fa-475d-af4f-c2f93571f4fe\nstatus: test\ndescription: |\n    This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.\n    This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent.\nreferences:\n    - https://o365blog.com/post/hybridhealthagent/\n    - https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-08-26\nmodified: 2022-10-09\ntags:\n    - attack.discovery\n    - attack.t1012\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID:\n            - 4656\n            - 4663\n        ObjectType: 'Key'\n        ObjectName: '\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent'\n    filter:\n        ProcessName|contains:\n            - 'Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe'\n            - 'Microsoft.Identity.Health.Adfs.InsightsService.exe'\n            - 'Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe'\n            - 'Microsoft.Identity.Health.Adfs.PshSurrogate.exe'\n            - 'Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe'\n    condition: selection and not filter\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1012","id":"T1012","name":"Query Registry","page":"techniques/enterprise/T1012/"}],"data_path":"data/detection-rules/ff151c33-45fa-475d-af4f-c2f93571f4fe.json","kind":"sigma"}