{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/azure-ad-hybrid-health/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Azure Active Directory","Azure AD Hybrid Health"],"_cs_severities":["medium"],"_cs_tags":["defense-impairment","cloud","azure"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThreat actors can manipulate Azure AD Hybrid Health for AD FS to compromise the integrity of authentication logs. By creating a rogue AD FS service instance and registering a fake server, attackers can inject spoofed AD FS signing events into the environment. Once the malicious activity is completed or the attacker no longer requires the persistence mechanism, they delete the rogue AD FS service instance via the Azure Management API. This deletion is a critical telemetry point for security operations centers, as it often marks the conclusion of a log manipulation campaign that may have been used to bypass identity-based detections or hide unauthorized access. Monitoring for these specific service deletions provides visibility into potential efforts to impair defensive visibility within a hybrid identity environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains administrative access to the Azure tenant (e.g., via compromised credentials).\u003c/li\u003e\n\u003cli\u003eAttacker registers a new Azure AD Hybrid Health AD FS service instance.\u003c/li\u003e\n\u003cli\u003eAttacker adds a rogue server to the AD FS health environment.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the rogue server to inject spoofed AD FS authentication logs.\u003c/li\u003e\n\u003cli\u003eAttacker performs malicious operations elsewhere in the environment, masked by spoofed events.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a delete request via the Azure AD Hybrid Health API for the malicious service instance.\u003c/li\u003e\n\u003cli\u003eAzure Resource Manager processes the 'MICROSOFT.ADHYBRIDHEALTHSERVICE/SERVICES/DELETE' operation.\u003c/li\u003e\n\u003cli\u003eUnauthorized health service is removed, effectively cleaning up evidence of the spoofing infrastructure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact is the loss of reliable authentication telemetry. If successful, an attacker can mask lateral movement or account manipulation by injecting benign-appearing authentication logs from a non-existent or rogue source. This undermines the capability of identity protection systems to flag anomalous login activity, potentially allowing attackers to maintain access for extended periods without detection.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to monitor for the deletion of AAD Hybrid Health service instances.\u003c/li\u003e\n\u003cli\u003eAudit all current AD Hybrid Health service instances within the tenant to ensure only authorized infrastructure is present.\u003c/li\u003e\n\u003cli\u003eEstablish an alert for any new 'MICROSOFT.ADHYBRIDHEALTHSERVICE/SERVICES/WRITE' operations to detect the creation of unauthorized AD FS health instances.\u003c/li\u003e\n\u003cli\u003eRestrict Azure RBAC roles that allow the modification or deletion of Hybrid Health service configurations to a limited set of verified identity administrators.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T02:44:27Z","date_published":"2026-10-21T02:44:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aad-hybrid-health-delete/","summary":"Attackers may delete Azure AD Hybrid Health AD FS service instances to conceal the removal of fake servers used for spoofing AD FS signing logs.","title":"Azure AD Hybrid Health AD FS Service deletion","url":"https://feed.craftedsignal.io/briefs/2026-10-aad-hybrid-health-delete/"}],"language":"en","title":"CraftedSignal Threat Feed - Azure AD Hybrid Health","version":"https://jsonfeed.org/version/1.1"}