Azure AD Hybrid Health AD FS Service deletion

Threat actors can manipulate Azure AD Hybrid Health for AD FS to compromise the integrity of authentication logs. By creating a rogue AD FS service instance and registering a fake server, attackers can inject spoofed AD FS signing events into the environment. Once the malicious activity is completed or the attacker no longer requires the persistence mechanism, they delete the rogue AD FS service instance via the Azure Management API. This deletion is a critical telemetry point for security operations centers, as it often marks the conclusion of a log manipulation campaign that may have been used to bypass identity-based detections or hide unauthorized access. Monitoring for these specific service deletions provides visibility into potential efforts to impair defensive visibility within a hybrid identity environment.

Attack Chain

1. Attacker gains administrative access to the Azure tenant (e.g., via compromised credentials).
2. Attacker registers a new Azure AD Hybrid Health AD FS service instance.
3. Attacker adds a rogue server to the AD FS health environment.
4. Attacker leverages the rogue server to inject spoofed AD FS authentication logs.
5. Attacker performs malicious operations elsewhere in the environment, masked by spoofed events.
6. Attacker initiates a delete request via the Azure AD Hybrid Health API for the malicious service instance.
7. Azure Resource Manager processes the 'MICROSOFT.ADHYBRIDHEALTHSERVICE/SERVICES/DELETE' operation.
8. Unauthorized health service is removed, effectively cleaning up evidence of the spoofing infrastructure.

Impact

The primary impact is the loss of reliable authentication telemetry. If successful, an attacker can mask lateral movement or account manipulation by injecting benign-appearing authentication logs from a non-existent or rogue source. This undermines the capability of identity protection systems to flag anomalous login activity, potentially allowing attackers to maintain access for extended periods without detection.

Recommendation

• Deploy the provided Sigma rule to your SIEM to monitor for the deletion of AAD Hybrid Health service instances.
• Audit all current AD Hybrid Health service instances within the tenant to ensure only authorized infrastructure is present.
• Establish an alert for any new 'MICROSOFT.ADHYBRIDHEALTHSERVICE/SERVICES/WRITE' operations to detect the creation of unauthorized AD FS health instances.
• Restrict Azure RBAC roles that allow the modification or deletion of Hybrid Health service configurations to a limited set of verified identity administrators.