A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
5 Days
Required Data
Azure Audit Log
Detection Modules
Cloud
ATT&CK Tactic
Discovery (TA0007)
ATT&CK Technique
Account Discovery (T1087)
Severity
Informational
Description
A new server has been added to an Azure Active Directory Hybrid Health AD FS Environment.
Attacker's Goals
Gain access to sensitive data stored in the new server.* Gain access to other servers in the Azure Active Directory Hybrid Health AD FS Environment.* Gain access to user accounts in the Azure Active Directory Hybrid Health AD FS Environment.
Investigative actions
Check the Azure Active Directory Hybrid Health Monitor to identify the new server.* Verify that the new server is correctly configured for ADFS.* Check the logs for any errors related to the new server.
Was this helpful?