Detect Hybrid Identity in Elastic Security
Adversaries may patch or backdoor cloud authentication processes tied to on-premises identities to bypass authentication, access credentials, and enable persistent access. Methods include: injecting a malicious DLL (PTASpy via AADInternals) into the AzureADConnectAuthenticationAgentService to authorize all authentication attempts and record credentials; modifying Microsoft.IdentityServer.Servicehost.exe.config (ADFS) to load a malicious DLL generating tokens for any user (APT29 MagicWeb); and registering a new PTA agent via the web console. Detection requires monitoring of Azure AD Connect processes, ADFS configuration files, and PTA agent registrations.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.007 Hybrid Identity
- Canonical reference
- https://attack.mitre.org/techniques/T1556/007/
Elastic Detection Query
any where
(
event.dataset == "azure.auditlogs" and
azure.auditlogs.operation_name : ("Add agent to application", "Register connector", "Agent health status", "Pass-through authentication agent")
) or
(
event.category == "file" and
event.action in ("creation", "modification") and
file.path : ("*\\ADFS\\*", "*\\Microsoft.IdentityServer*", "*\\AzureADConnectAuthenticationAgentService*") and
file.extension in ("dll", "config", "exe")
) or
(
event.category == "process" and
(
process.name : "AzureADConnectAuthenticationAgentService.exe" or
process.parent.name : "AzureADConnectAuthenticationAgentService.exe"
) and
not process.parent.name : ("services.exe", "svchost.exe")
)Detects T1556.007 Hybrid Identity attacks across three vectors: PTA agent registration in Azure AD audit logs (azure.auditlogs), file creation or modification targeting ADFS and AzureADConnect directories for DLLs, configs, and executables, and anomalous child process spawning by AzureADConnectAuthenticationAgentService.exe from non-standard parent processes. Covers PTASpy injection, MagicWeb ADFS DLL backdoor, and rogue PTA agent registration.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate PTA agent registration during a planned Azure AD Connect installation or upgrade performed by an authorized identity team administrator
- Microsoft patch management or SCCM writing updated ADFS binaries and configuration files to monitored directories during a scheduled maintenance window
- Security scanning or backup tooling that enumerates ADFS directories, triggering file-category events without performing actual modifications
Other platforms for T1556.007
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1List Current PTA Agents (Reconnaissance)
Expected signal: Azure AD audit log: OperationName 'Get service principal' — read operations. PowerShell ScriptBlock Log Event ID 4104 with the Get-AzureADServicePrincipal command. Network connection from PowerShell to Azure AD Graph API endpoints.
- Test 2Check ADFS Configuration File Integrity
Expected signal: Sysmon Event ID 12/13 (Registry) or Event ID 7 (ImageLoad) from PowerShell accessing ADFS directories. File access events in Security Event Log (4663) if file system auditing is enabled on the ADFS directory.
- Test 3Simulate AADInternals PTASpy Installation Indicators
Expected signal: PowerShell ScriptBlock Log Event ID 4104 with the simulation command. Sysmon Event ID 1 for powershell.exe. Any Get-Service calls appear in PowerShell module logging (Event ID 4103).
References (6)
- https://attack.mitre.org/techniques/T1556/007/
- https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
- https://blog.xpnsec.com/azuread-connect-for-redteam/
- https://o365blog.com/post/on-prem_admin/
- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.007/T1556.007.md
Unlock Pro Content
Get the full detection package for T1556.007 including response playbook, investigation guide, and atomic red team tests.