ADFS Database Named Pipe Connection By Uncommon Tool
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_pipe_created" AND OBJECTNAME = "\MICROSOFT##WID\tsql\query" AND PROCESSNAME notendswith ":\Windows\System32\mmc.exe,:\Windows\system32\svchost.exe,:\Windows\System32\wsmprovhost.exe,:\Windows\SysWOW64\mmc.exe,:\Windows\SysWOW64\wsmprovhost.exe,:\Windows\WID\Binn\sqlwriter.exe,\AzureADConnect.exe,\Microsoft.Identity.Health.Adfs.PshSurrogate.exe,\Microsoft.IdentityServer.ServiceHost.exe,\Microsoft.Tri.Sensor.exe,\sqlservr.exe,\tssdis.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.OBJECTNAME,Action1.ACCESSES
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Roberto Rodriguez @Cyb3rWard0g
