deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Stale Accounts In A Privileged Role
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-14
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies when an account hasn't signed in during the past n number of days.

Detection logic:
{
  "selection": {
    "riskEventType": "staleSignInAlertIncident"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#potential-stale-accounts-in-a-privileged-role
Sigma Detection Rule: Invalid PIM License
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-14
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Detection logic:
{
  "selection": {
    "riskEventType": "invalidLicenseAlertIncident"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#the-organization-doesnt-have-microsoft-entra-premium-p2-or-microsoft-entra-id-governance
Sigma Detection Rule: Roles Activated Too Frequently
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-14
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies when the same privilege role has multiple activations by the same user.

Detection logic:
{
  "selection": {
    "riskEventType": "sequentialActivationRenewalsAlertIncident"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently
Sigma Detection Rule: Roles Assigned Outside PIM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-14
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Detection logic:
{
  "selection": {
    "riskEventType": "rolesAssignedOutsidePrivilegedIdentityManagementAlertConfiguration"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-assigned-outside-of-privileged-identity-management
Sigma Detection Rule: Azure AD Account Credential Leaked
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1589
Log source: azure/

Description:
Indicates that the user's valid credentials have been leaked.

Detection logic:
{
  "selection": {
    "riskEventType": "leakedCredentials"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#leaked-credentials
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Primary Refresh Token Access Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-07
ATT&CK techniques: T1528
Log source: azure/

Description:
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft

Detection logic:
{
  "selection": {
    "riskEventType": "attemptedPrtAccess"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#possible-attempt-to-access-primary-refresh-token-prt
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Anonymous IP Address
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Gloria Lee, '@gleeiamglo'
Date: 2023-08-22
ATT&CK techniques: T1528
Log source: azure/

Description:
Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Detection logic:
{
  "selection": {
    "riskEventType": "anonymizedIPAddress"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anonymous-ip-address
Sigma Detection Rule: Password Spray Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1110
Log source: azure/

Description:
Indicates that a password spray attack has been successfully performed.

Detection logic:
{
  "selection": {
    "riskEventType": "passwordSpray"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Atypical Travel
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Detection logic:
{
  "selection": {
    "riskEventType": "unlikelyTravel"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Malicious IP Address Sign-In Suspicious
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-07
ATT&CK techniques: T1090
Log source: azure/

Description:
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

Detection logic:
{
  "selection": {
    "riskEventType": "suspiciousIPAddress"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Anomalous User Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1098
Log source: azure/

Description:
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Detection logic:
{
  "selection": {
    "riskEventType": "anomalousUserActivity"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-user-activity
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Activity From Anonymous IP Address
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Detection logic:
{
  "selection": {
    "riskEventType": "riskyIPAddress"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#activity-from-anonymous-ip-address
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Suspicious Inbox Manipulation Rules
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1140
Log source: azure/

Description:
Detects suspicious rules that delete or move messages or folders are set on a user's inbox.

Detection logic:
{
  "selection": {
    "riskEventType": "mcasSuspiciousInboxManipulationRules"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-manipulation-rules
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Malicious IP Address Sign-In Failure Rate
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-07
ATT&CK techniques: T1090
Log source: azure/

Description:
Indicates sign-in from a malicious IP address based on high failure rates.

Detection logic:
{
  "selection": {
    "riskEventType": "maliciousIPAddress"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Suspicious Inbox Forwarding Identity Protection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1114.003
Log source: azure/

Description:
Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address

Detection logic:
{
  "selection": {
    "riskEventType": "suspiciousInboxForwarding"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Sign-In From Malware Infected IP
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1090
Log source: azure/

Description:
Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Detection logic:
{
  "selection": {
    "riskEventType": "malwareInfectedIPAddress"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Unfamiliar Sign-In Properties
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Detection logic:
{
  "selection": {
    "riskEventType": "unfamiliarFeatures"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#unfamiliar-sign-in-properties
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Impossible Travel
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Detection logic:
{
  "selection": {
    "riskEventType": "impossibleTravel"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: New Country
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Detection logic:
{
  "selection": {
    "riskEventType": "newCountry"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Azure AD Threat Intelligence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-07
ATT&CK techniques: T1078
Log source: azure/

Description:
Indicates user activity that is unusual for the user or consistent with known attack patterns.

Detection logic:
{
  "selection": {
    "riskEventType": "investigationsThreatIntelligence"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Anomalous Token
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow'
Date: 2023-08-07
ATT&CK techniques: T1528
Log source: azure/

Description:
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

Detection logic:
{
  "selection": {
    "riskEventType": "anomalousToken"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-token
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Suspicious Browser Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1078
Log source: azure/

Description:
Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Detection logic:
{
  "selection": {
    "riskEventType": "suspiciousBrowser"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: SAML Token Issuer Anomaly
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-03
ATT&CK techniques: T1606
Log source: azure/

Description:
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Detection logic:
{
  "selection": {
    "riskEventType": "tokenIssuerAnomaly"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#token-issuer-anomaly
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
Sigma Detection Rule: Azure Virtual Network Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-08
Log source: azure/

Description:
Identifies when a Virtual Network is modified or deleted in Azure.

Detection logic:
{
  "selection": {
    "operationName|startswith": [
      "MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/",
      "MICROSOFT.NETWORK/VIRTUALNETWORKS/"
    ],
    "operationName|endswith": [
      "/WRITE",
      "/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Kubernetes Pods Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-07-24
Log source: azure/

Description:
Identifies the deletion of Azure Kubernetes Pods.

Detection logic:
{
  "selection": {
    "operationName": "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://github.com/elastic/detection-rules/blob/065bf48a9987cd8bd826c098a30ce36e6868ee46/rules/integrations/azure/impact_kubernetes_pod_deleted.toml
Sigma Detection Rule: Azure Service Principal Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-02
Log source: azure/

Description:
Identifies when a service principal is created in Azure.

Detection logic:
{
  "selection": {
    "properties.message": "Add service principal"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy
Sigma Detection Rule: Azure DNS Zone Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-08
ATT&CK techniques: T1565.001
Log source: azure/

Description:
Identifies when DNS zone is modified or deleted.

Detection logic:
{
  "selection": {
    "operationName|startswith": "MICROSOFT.NETWORK/DNSZONES",
    "operationName|endswith": [
      "/WRITE",
      "/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
Sigma Detection Rule: Azure Container Registry Created or Deleted
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-07
ATT&CK techniques: T1485, T1496, T1489
Log source: azure/

Description:
Detects when a Container Registry is created or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.CONTAINERREGISTRY/REGISTRIES/WRITE",
      "MICROSOFT.CONTAINERREGISTRY/REGISTRIES/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1
Sigma Detection Rule: Azure Firewall Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-08
ATT&CK techniques: T1686.001
Log source: azure/

Description:
Identifies when a firewall is created, modified, or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Rare Subscription-level Operations In Azure
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: sawwinnnaung
Date: 2020-05-07
ATT&CK techniques: T1003
Log source: azure/

Description:
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Detection logic:
{
  "keywords": [
    "Microsoft.DocumentDB/databaseAccounts/listKeys/action",
    "Microsoft.Maps/accounts/listKeys/action",
    "Microsoft.Media/mediaservices/listKeys/action",
    "Microsoft.CognitiveServices/accounts/listKeys/action",
    "Microsoft.Storage/storageAccounts/listKeys/action",
    "Microsoft.Compute/snapshots/write",
    "Microsoft.Network/networkSecurityGroups/write"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml
Sigma Detection Rule: Azure Kubernetes Network Policy Change
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-07
ATT&CK techniques: T1485, T1496, T1489
Log source: azure/

Description:
Identifies when a Azure Kubernetes network policy is modified or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/DELETE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1
Sigma Detection Rule: Azure Suppression Rule Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-08-16
Log source: azure/

Description:
Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

Detection logic:
{
  "selection": {
    "operationName": "MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Active Directory Hybrid Health AD FS Service Delete
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-08-26
ATT&CK techniques: T1578.003
Log source: azure/

Description:
This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.
A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.


Detection logic:
{
  "selection": {
    "CategoryValue": "Administrative",
    "ResourceProviderValue": "Microsoft.ADHybridHealthService",
    "ResourceId|contains": "AdFederationService",
    "OperationNameValue": "Microsoft.ADHybridHealthService/services/delete"
  },
  "condition": "selection"
}

References:
  - https://o365blog.com/post/hybridhealthagent/