{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amicrosoftentra_id_hybrid_health/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:entra_id_hybrid_health:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Entra ID Hybrid Health AD FS"],"_cs_severities":["medium"],"_cs_tags":["azure","identity","defense-evasion","cloud-security"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eResearch indicates that attackers can manipulate the Microsoft Entra ID Hybrid Health AD FS service to report fraudulent server instances. By programmatically interacting with the Azure resource provider, an attacker can create a new AD FS service and register a rogue server instance without needing access to the physical, on-premises Active Directory Federation Services (AD FS) infrastructure. This technique allows adversaries to inject fake authentication events into the environment, potentially masking malicious activity or generating noise to facilitate unauthorized access. Defenders should monitor the administrative activity logs in Azure for the creation or modification of these service members, as this behavior is often indicative of reconnaissance or persistence attempts within the identity environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful manipulation of the AD FS Hybrid Health service can allow attackers to spoof identity provider signing logs. This impacts the integrity of authentication telemetry, complicates incident response by introducing false event data, and may allow attackers to bypass security monitoring systems that rely on AD FS telemetry to detect anomalous authentication patterns.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor Azure Activity Logs for the registration of new AD FS service members using the detection rule provided in this brief.\u003c/li\u003e\n\u003cli\u003eAudit existing AD FS service instances in the Azure portal to ensure all registered servers are legitimate and authorized.\u003c/li\u003e\n\u003cli\u003eEnforce strict Azure Role-Based Access Control (RBAC) to limit the ability of service principals or users to perform operations within the Microsoft.ADHybridHealthService resource provider.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to the SIEM to detect suspicious service member additions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T02:44:19Z","date_published":"2026-10-21T02:44:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-azure-ad-hybrid-health-spoofing/","summary":"Threat actors can register unauthorized server instances within the Microsoft Entra ID (formerly Azure AD) Hybrid Health AD FS service to spoof signing logs and bypass authentication monitoring.","title":"Microsoft Entra ID Hybrid Health AD FS service manipulation","url":"https://feed.craftedsignal.io/briefs/2026-10-azure-ad-hybrid-health-spoofing/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:microsoft:entra_id_hybrid_health:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}