
title: Azure AD Health Monitoring Agent Registry Keys Access
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021/08/26
description: |
  This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.
  This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.
detection:
  SELECTION_1:
    EventID: 4656
  SELECTION_2:
    EventID: 4663
  SELECTION_3:
    ObjectType: Key
  SELECTION_4:
    ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent
  SELECTION_5:
    ProcessName:
    - '*Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe*'
    - '*Microsoft.Identity.Health.Adfs.InsightsService.exe*'
    - '*Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe*'
    - '*Microsoft.Identity.Health.Adfs.PshSurrogate.exe*'
    - '*Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe*'
  condition: (((SELECTION_1 or SELECTION_2) and SELECTION_3 and SELECTION_4) and  not
    (SELECTION_5))
falsepositives:
- Unknown
id: ff151c33-45fa-475d-af4f-c2f93571f4fe
level: medium
logsource:
  product: windows
  service: security
references:
- https://o365blog.com/post/hybridhealthagent/
- https://github.com/OTRF/Set-AuditRule/blob/master/rules/registry/aad_connect_health_monitoring_agent.yml
status: experimental
tags:
- attack.discovery
- attack.t1012
ruletype: SIGMA
