Suspicious AADConnect Process Execution
This rule detects suspicious execution of AADConnect synchronization processes (ADSync.exe or Microsoft.Azure.AD.Sync.exe) that are not initiated by the services.exe parent process or do not contain 'scheduled' in their command line. This pattern could indicate an attacker attempting to manipulate or leverage AADConnect for privilege escalation or lateral movement between on-premises and cloud environments, as observed in Silk Typhoon activity.
Sigma
