oproblemas

Copper Contributor

First of all, thanks for the help.


I'm trying an attack/detection of an azure activity rule and I have several questions.
The attack is to register a new ADFS server.
It is supposed that according to the rule, when I register it, it should appear in the AzureActivity table. I paste the rule:
AzureActivity
| where CategoryValue =~ 'Administrative'
| where ResourceProviderValue =~ 'Microsoft.ADHybridHealthService'
| where _ResourceId has 'AdFederationService'
| where OperationNameValue =~ 'Microsoft.ADHybridHealthService/services/servicemembers/action'
| extend claimsJson = parse_json(Claims)
| extend AppId = tostring(claimsJson.appid), AccountName = tostring(claimsJson.name), Name = tostring(split(Caller,'@',0)[0]), UPNSuffix = tostring(split(Caller,'@',1)[0])
| project-away claimsJson

 

But AzureActivity doesn't have any log of this type.
I'm pasting the image where the event DOES appear.

 

Captura de pantalla 2024-09-07 a las 11.47.49.png

 

If I search for Msgraph api, these logs appear, I paste the search here.

 

Captura de pantalla 2024-09-07 a las 11.55.59.png

 

 

My conclusion is that the directory activity log is not being saved in AzureActivity, but I'm confused because the rule refers to that table. The rule is: 88f453ff-7b9e-45bb-8c12-4058ca5e44ee ( Microsoft Entra ID Hybrid Health AD FS New Server )

Can you help me with this case?

Thanks!!

0 Replies