A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment

Analytics BIOC Informational

A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment

A new server has been added to an Azure Active Directory Hybrid Health AD FS Environment.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: Azure Audit Log

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Account Discovery (T1087)

Attacker's goals:

Gain access to sensitive data stored in the new server.* Gain access to other servers in the Azure Active Directory Hybrid Health AD FS Environment.* Gain access to user accounts in the Azure Active Directory Hybrid Health AD FS Environment.

Investigative actions:

Check the Azure Active Directory Hybrid Health Monitor to identify the new server.* Verify that the new server is correctly configured for ADFS.* Check the logs for any errors related to the new server.

Test period:: N/A (single event)
Deduplication:: 5 Days