Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Azure AD Connect (AAD Connect) is a critical service that handles connections between on-premise Active Directory and Azure AD. Due to the critical nature of AAD Connect threat actors may attempt to compromise the service in order to access credentials. This query looks for SSH connections to host that appear to run AAD Connect. The results should be reviewed to determine if the SSH connection is legitimate.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | GitHub Only |
| ID | 7f52bc1d-138e-4a02-af25-a04dbea85646 |
| Tactics | Persistence |
| Techniques | T1133 |
| Required Connectors | MicrosoftThreatProtection |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
DeviceInfo |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊