Azure Active Directory Hybrid Health AD FS Service Delete

SigmaHQ Detections@sigmaHQ

•updated 2 days ago•2•0•7

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.