Azure AD Health Service Agents Registry Key Access
This detection identifies suspicious access attempts to registry keys and sub-keys associated with Azure AD Health service agents, such as AD FS. Gaining access to this information could enable an adversary to abuse features provided by these cloud services, particularly federation. The rule requires specific System Access Control List (SACL) auditing to be configured on 'HKLM:\SOFTWARE\Microsoft\ADHealthAgent' with propagation to sub-keys.
Sigma
