Detect Hybrid Identity in Microsoft Sentinel
Adversaries may patch or backdoor cloud authentication processes tied to on-premises identities to bypass authentication, access credentials, and enable persistent access. Methods include: injecting a malicious DLL (PTASpy via AADInternals) into the AzureADConnectAuthenticationAgentService to authorize all authentication attempts and record credentials; modifying Microsoft.IdentityServer.Servicehost.exe.config (ADFS) to load a malicious DLL generating tokens for any user (APT29 MagicWeb); and registering a new PTA agent via the web console. Detection requires monitoring of Azure AD Connect processes, ADFS configuration files, and PTA agent registrations.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.007 Hybrid Identity
- Canonical reference
- https://attack.mitre.org/techniques/T1556/007/
KQL Detection Query
let PTAAgentEvents = AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName has_any (
"Add agent to application",
"Register connector",
"Agent health status",
"Pass-through authentication agent"
)
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| project TimeGenerated, OperationName, Actor, Result, ResultDescription;
let ADFSServiceEvents = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (
@"\ADFS\", @"\Microsoft.IdentityServer",
@"\AzureADConnectAuthenticationAgentService"
)
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".dll" or FileName endswith ".config" or FileName endswith ".exe"
| project Timestamp, DeviceName, FolderPath, FileName, ActionType,
InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
let AzureADConnectProcess = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "AzureADConnectAuthenticationAgentService.exe"
or FileName =~ "AzureADConnectAuthenticationAgentService.exe"
| where ProcessCommandLine has_any ("inject", "dll", "-", "PTASpy")
or InitiatingProcessFileName !in~ ("services.exe", "svchost.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
union PTAAgentEvents, ADFSServiceEvents, AzureADConnectProcess
| sort by TimeGenerated desc, Timestamp descDetects hybrid identity authentication backdoors via Azure AD audit logs for new PTA agent registrations, file monitoring of ADFS configuration and DLL files, and process monitoring of the AzureADConnectAuthenticationAgentService. APT29's MagicWeb modifies the ADFS servicehost config, PTASpy injects into the PTA agent service.
Data Sources
Required Tables
False Positives & Tuning
- Authorized Azure AD Connect upgrades that modify PTA agent binaries and configuration files
- Legitimate new PTA agent registration during Azure AD Connect scale-out deployments
- ADFS server updates or patches that modify Microsoft.IdentityServer binaries
- Configuration management tools (Ansible, DSC) deploying authorized ADFS configuration changes
Other platforms for T1556.007
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1List Current PTA Agents (Reconnaissance)
Expected signal: Azure AD audit log: OperationName 'Get service principal' — read operations. PowerShell ScriptBlock Log Event ID 4104 with the Get-AzureADServicePrincipal command. Network connection from PowerShell to Azure AD Graph API endpoints.
- Test 2Check ADFS Configuration File Integrity
Expected signal: Sysmon Event ID 12/13 (Registry) or Event ID 7 (ImageLoad) from PowerShell accessing ADFS directories. File access events in Security Event Log (4663) if file system auditing is enabled on the ADFS directory.
- Test 3Simulate AADInternals PTASpy Installation Indicators
Expected signal: PowerShell ScriptBlock Log Event ID 4104 with the simulation command. Sysmon Event ID 1 for powershell.exe. Any Get-Service calls appear in PowerShell module logging (Event ID 4103).
References (6)
- https://attack.mitre.org/techniques/T1556/007/
- https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
- https://blog.xpnsec.com/azuread-connect-for-redteam/
- https://o365blog.com/post/on-prem_admin/
- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.007/T1556.007.md
Unlock Pro Content
Get the full detection package for T1556.007 including response playbook, investigation guide, and atomic red team tests.