Azure AD Health Monitoring Agent Registry Key Access
This rule detects suspicious access attempts to the registry key associated with the Azure AD Health monitoring agent. It specifically looks for Event IDs 4656 (handle to an object was requested) or 4663 (an attempt was made to access an object) on the registry key '\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent'. The rule filters out access attempts made by legitimate Azure AD Health monitoring agent processes to reduce false positives. This detection requires specific SACL auditing to be configured on the registry key.
Sigma
