Microsoft Entra ID Hybrid Health AD FS service manipulation

Research indicates that attackers can manipulate the Microsoft Entra ID Hybrid Health AD FS service to report fraudulent server instances. By programmatically interacting with the Azure resource provider, an attacker can create a new AD FS service and register a rogue server instance without needing access to the physical, on-premises Active Directory Federation Services (AD FS) infrastructure. This technique allows adversaries to inject fake authentication events into the environment, potentially masking malicious activity or generating noise to facilitate unauthorized access. Defenders should monitor the administrative activity logs in Azure for the creation or modification of these service members, as this behavior is often indicative of reconnaissance or persistence attempts within the identity environment.

Impact

Successful manipulation of the AD FS Hybrid Health service can allow attackers to spoof identity provider signing logs. This impacts the integrity of authentication telemetry, complicates incident response by introducing false event data, and may allow attackers to bypass security monitoring systems that rely on AD FS telemetry to detect anomalous authentication patterns.

Recommendation

• Monitor Azure Activity Logs for the registration of new AD FS service members using the detection rule provided in this brief.
• Audit existing AD FS service instances in the Azure portal to ensure all registered servers are legitimate and authorized.
• Enforce strict Azure Role-Based Access Control (RBAC) to limit the ability of service principals or users to perform operations within the Microsoft.ADHybridHealthService resource provider.
• Deploy the Sigma rule below to the SIEM to detect suspicious service member additions.