
title: Azure AD Health Service Agents Registry Keys Access
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021/08/26
description: |
  This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).
  Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).
  This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent.
  Make sure you set the SACL to propagate to its sub-keys.
detection:
  SELECTION_1:
    EventID: 4656
  SELECTION_2:
    EventID: 4663
  SELECTION_3:
    ObjectType: Key
  SELECTION_4:
    ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\ADHealthAgent
  SELECTION_5:
    ProcessName:
    - '*Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe*'
    - '*Microsoft.Identity.Health.Adfs.InsightsService.exe*'
    - '*Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe*'
    - '*Microsoft.Identity.Health.Adfs.PshSurrogate.exe*'
    - '*Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe*'
  condition: (((SELECTION_1 or SELECTION_2) and SELECTION_3 and SELECTION_4) and  not
    (SELECTION_5))
falsepositives:
- Unknown
id: 1d2ab8ac-1a01-423b-9c39-001510eae8e8
level: medium
logsource:
  product: windows
  service: security
references:
- https://o365blog.com/post/hybridhealthagent/
- https://github.com/OTRF/Set-AuditRule/blob/master/rules/registry/aad_connect_health_service_agent.yml
status: experimental
tags:
- attack.discovery
- attack.t1012
ruletype: SIGMA
