Detect Hybrid Identity in CrowdStrike LogScale
Adversaries may patch or backdoor cloud authentication processes tied to on-premises identities to bypass authentication, access credentials, and enable persistent access. Methods include: injecting a malicious DLL (PTASpy via AADInternals) into the AzureADConnectAuthenticationAgentService to authorize all authentication attempts and record credentials; modifying Microsoft.IdentityServer.Servicehost.exe.config (ADFS) to load a malicious DLL generating tokens for any user (APT29 MagicWeb); and registering a new PTA agent via the web console. Detection requires monitoring of Azure AD Connect processes, ADFS configuration files, and PTA agent registrations.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.007 Hybrid Identity
- Canonical reference
- https://attack.mitre.org/techniques/T1556/007/
LogScale Detection Query
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2|FileWritten|PeFileWritten/
| test {
ImageFileName = /(?i)AzureADConnectAuthenticationAgentService\.exe/
OR TargetFileName = /(?i)(\\ADFS\\|Microsoft\.IdentityServer|AzureADConnectAuthentication).+\.(dll|config|exe)$/
OR (
ImageFileName = /(?i)AzureADConnectAuthenticationAgentService/
AND NOT ParentBaseFileName = /(?i)(services\.exe|svchost\.exe)/
)
}
| DetectionType := if(
TargetFileName = /(?i)\.(dll|config)$/, "ADFS_File_Tampering",
if(
ImageFileName = /(?i)AzureADConnectAuthenticationAgentService/
AND NOT ParentBaseFileName = /(?i)(services\.exe|svchost\.exe)/,
"Suspicious_PTA_Spawn",
"AzureADConnect_File_Activity"
)
)
| select([ComputerName, DetectionType, #event_simpleName, ImageFileName, CommandLine, ParentBaseFileName, TargetFileName, UserName, SHA256HashData])
| sort(field=@timestamp, order=desc)CrowdStrike LogScale (Falcon CQL) detection for T1556.007 Hybrid Identity using ProcessRollup2, SyntheticProcessRollup2, FileWritten, and PeFileWritten Falcon telemetry events. Detects three behavioral patterns: DLL or config file writes into ADFS and AzureADConnect directories (PTASpy/MagicWeb staging), AzureADConnectAuthenticationAgentService.exe launched by unexpected parent processes (DLL injection side effect), and general AzureADConnect file activity for broader coverage. Results are classified by DetectionType and enriched with SHA256 for IOC pivoting.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor self-updates or policy enforcement actions that write files to monitored identity service directories, generating PeFileWritten events
- Legitimate IT automation pipelines (Ansible, SCCM, Intune) deploying Azure AD Connect upgrades that produce correlated ProcessRollup2 and FileWritten events within the same time window
- Microsoft Identity Manager or other IAM federation products co-located with ADFS that write to overlapping directory paths and launch child processes during normal operation
Other platforms for T1556.007
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1List Current PTA Agents (Reconnaissance)
Expected signal: Azure AD audit log: OperationName 'Get service principal' — read operations. PowerShell ScriptBlock Log Event ID 4104 with the Get-AzureADServicePrincipal command. Network connection from PowerShell to Azure AD Graph API endpoints.
- Test 2Check ADFS Configuration File Integrity
Expected signal: Sysmon Event ID 12/13 (Registry) or Event ID 7 (ImageLoad) from PowerShell accessing ADFS directories. File access events in Security Event Log (4663) if file system auditing is enabled on the ADFS directory.
- Test 3Simulate AADInternals PTASpy Installation Indicators
Expected signal: PowerShell ScriptBlock Log Event ID 4104 with the simulation command. Sysmon Event ID 1 for powershell.exe. Any Get-Service calls appear in PowerShell module logging (Event ID 4103).
References (6)
- https://attack.mitre.org/techniques/T1556/007/
- https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
- https://blog.xpnsec.com/azuread-connect-for-redteam/
- https://o365blog.com/post/on-prem_admin/
- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.007/T1556.007.md
Unlock Pro Content
Get the full detection package for T1556.007 including response playbook, investigation guide, and atomic red team tests.