41554 blogs · 4,417,066 posts Claim your blog

Record · corpus.blog/posts/01a0871e-2e5f-725b-a4fc-7d978c57f440

Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agent

aadinternals.com · published 8 July 2021

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at aadinternals.com Wayback capture

1blogs citing

First cited: 11 Jan 2023
Most recent: 11 Jan 2023
Rank this month: not ranked
Links from this post: 9
Words captured: 4,735

Cited by

Blog

In the post

Date

Detecting Fake Events in Azure Sign-in Logs Read at the source ↗

11 Jan 2023

Links from this post

Link

Host

https://www.secureworks.com/research/azure-active-directory-sign-ins-log-tampering

secureworks.com

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-azure-ad-connect

docs.microsoft.com

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/march-identity-updates-public-preview-of-ad-fs-sign-in-activity/ba-p/1994705

techcommunity.microsoft.com

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-ad-fs-sign-in

docs.microsoft.com

https://twitter.com/Cyb3rWard0g

twitter.com

https://github.com/SigmaHQ/sigma/pull/1934

github.com

https://github.com/search?q=repo%3AAzure%2FAzure-Sentinel+extension%3Ayaml+filename%3AAADHybridHealthADFSNewServer.yaml+filename%3AAADHybridHealthADFSServiceDelete.yaml+filename%3AAADHybridHealthADFSSuspApp.yaml+filename%3AAADHealthMonAgentRegKeyAccess.yaml+filename%3AAADHealthSvcAgentRegKeyAccess.yaml&type=Code&ref=advsearch&l=&l=

github.com

https://portal.azure.com/

portal.azure.com

Documentation Read at the source ↗

aadinternals.com