T1556.007 — Hybrid Identity

Tactics: Defense Impairment, Persistence, Credential Access · Platforms: IaaS, Identity Provider, Office Suite, SaaS, Windows

Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts. Many organizations maintain hybrid user and device…

Sub-technique of Modify Authentication Process (T1556).

Sigma detection rules (5)

T1556.007 Modify Authentication Process: Hybrid Identity

title: "T1556.007 Modify Authentication Process: Hybrid Identity"
id: fdef50c4-4460-4a67-ac22-22a4afd72ba9
description: 'Detects unsigned or non-Microsoft-signed modules loaded into AD FS and Azure AD Connect (hybrid identity) service processes, a proxy for backdooring/patching the hybrid authentication process (e.g. tampering with claims issuance or password-hash sync). (Data Component: Module Load.) Tune using: TrustedPublishers, WatchedServices.'
references:
  - https://attack.mitre.org/techniques/T1556/007
author: Shahrukh Khan
date: 2026-06-26
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.007

logsource:
  category: image_load
  product: windows

detection:
  selection_hybrid_identity_process:
    Image|endswith:
      - '\Microsoft.IdentityServer.ServiceHost.exe'
      - '\AzureADConnectAuthenticationAgentService.exe'
      - '\AzureADConnect.exe'
      - '\AADConnectHealthAdfsAgent.exe'
      - '\AADConnectHealthSyncAgent.exe'
      - '\Microsoft.Identity.Health.Adfs.InsightsService.exe'

  filter_signed_microsoft:
    Signed: true
    Company|contains: 'Microsoft'

  condition: selection_hybrid_identity_process and not filter_signed_microsoft

falsepositives:
  - Legitimate third-party security/monitoring agents injecting into AD FS or AAD Connect processes; validate signer and module path before alerting.

level: high

T1556.007 Modify Authentication Process: Hybrid Identity

title: "T1556.007 Modify Authentication Process: Hybrid Identity"
id: a5f5e34b-b736-478e-96b2-00c0978f4a6e
description: 'Detect Hybrid Identity Authentication Process Modification. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredFederations.'
references:
  - https://attack.mitre.org/techniques/T1556/007
author: Shahrukh Khan
date: 2026-03-23
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.007

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'iam.amazonaws.com'
    eventName:
      - 'UpdateSAMLProvider'
      - 'CreateSAMLProvider'
      - 'DeleteSAMLProvider'

  condition: selection

falsepositives:
  - Planned federation migrations or identity provider certificate rotations performed by identity engineering teams.

level: high

T1556.007 Modify Authentication Process: Hybrid Identity

title: "T1556.007 Modify Authentication Process: Hybrid Identity"
id: b7bd2134-ed2a-458f-bc45-c412d031ba8e
description: 'Detect Hybrid Identity Authentication Process Modification. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: FederationEndpoints.'
references:
  - https://attack.mitre.org/techniques/T1556/007
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.007

logsource:
  product: saas
  service: okta

detection:
  selection_federation_update:
    eventType:
      - 'application.lifecycle.update'
      - 'policy.lifecycle.update'
    debugContext.debugData.requestUri|contains:
      - 'idp'
      - 'federation'
  selection_trust_change:
    eventType: 'application.lifecycle.update'
    outcome.result: 'SUCCESS'

  condition: selection_federation_update or selection_trust_change

falsepositives:
  - Planned identity federation reconfiguration performed by an identity administrator during a migration window.

level: high

T1556.007 Modify Authentication Process: Hybrid Identity

title: "T1556.007 Modify Authentication Process: Hybrid Identity"
id: 213cb99e-b933-4529-b883-5bbe789d2504
description: 'Detect Hybrid Identity Authentication Process Modification. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: PrivilegedRoles.'
references:
  - https://attack.mitre.org/techniques/T1556/007
author: Shahrukh Khan
date: 2026-02-07
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.007

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    AppDisplayName: 'Microsoft Authentication Broker'
    ResultType: '0'
  selection_priv:
    AuthenticationRequirement: 'singleFactorAuthentication'
  condition: selection and selection_priv

falsepositives:
  - Hybrid identity trust configurations where federation servers are legitimately exempted from interactive MFA checks.

level: medium

T1556.007 Modify Authentication Process: Hybrid Identity

title: "T1556.007 Modify Authentication Process: Hybrid Identity"
id: cb2f39dd-5247-4fdd-b0e4-278ca23dd1df
description: 'Detect Hybrid Identity Authentication Process Modification. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: PolicyScope.'
references:
  - https://attack.mitre.org/techniques/T1556/007
author: Shahrukh Khan
date: 2026-03-24
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.007

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Set-AuthenticationPolicy'
      - 'Set-OrganizationConfig'
    Parameters.Name: 'HybridIdentityScope'

  condition: selection

falsepositives:
  - Planned changes to hybrid identity federation scope performed by the identity engineering team during a migration.

level: high

Related sub-techniques

Explore