Azure AD Hybrid Health AD FS New Server Instance Creation or Update

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•8•0•33

This detection identifies the creation or update of a server instance within an Azure AD Hybrid Health AD FS service using Azure Activity logs. An adversary might perform this action to create a new AD Health ADFS service and a fake server instance to spoof AD FS signing logs, potentially bypassing the need to compromise an on-premises AD FS server. This can be achieved programmatically via HTTP requests to Azure.