Unsigned module loaded into a hybrid identity agent process

Siemphony@siemphonymediumT1556.007unverified

AN0814 names "injection or tampering of DLLs in hybrid identity agents (e.g., AzureADConnectAuthenticationAgentService)" as its Windows signal. This rule expresses that literally on Sysmon EventID 7 (image_load): `Image` is the hybrid-identity process the module is loading into, and `Signed: false` is the tamper signal, the same field T1014's rule uses — but scoped here to a specific short list of processes rather than applied system-wide, which is what keeps this a distinct observable from T1014 rather than a re-tagged copy of it. `AzureADConnectAuthenticationAgentService.exe` is MITRE's own named example (the Pass-Through Authentication agent); `miiserver.exe` (the Azure AD Connect sync engine, which brokers Password Hash Sync) and `Microsoft.IdentityServer.ServiceHost.exe` (the AD FS service host) are this rule's own additions, not MITRE's, added because an attacker hooking either agent to harvest or bypass credentials — the documented behaviour behind public PTA-hooking proof-of-concept tooling — produces the identical unsigned-image-load observable in a different process. `Signed: false` inherits Sysmon's own signing-check caveat already documented against T1014: a genuinely Microsoft-signed module can still report unsigned if the load-time WinVerifyTrust catalog check cannot complete, most commonly on a host with no path to the certificate- revocation service. The registry/configuration leg of AN0814, mapped to Security EventID 5136, is not attempted: MITRE's description ("registry or configuration changes tied to PTA/AD FS") names no concrete object class, attribute or registry key the way this brief does for other 5136-based analytics (T1484's rule matches ObjectClass groupPolicyContainer and trustedDomain by name), and this pipeline has no reliable, sourced knowledge of AD FS's own directory or registry footprint to invent one honestly — a guessed ObjectClass or key path would be exactly the plausible-looking-but-dead selector this corpus exists to avoid. MITRE's `WatchedServices` knob is populated here with that process list, only the PTA agent entry actually named by MITRE — the other two are this rule's own additions as already noted above. `TimeWindow` (correlating the module load with a later logon anomaly) is not implemented, since lib/sigma has no cross-event join. Sysmon is not installed by default, and image_load (EventID 7) is the noisiest Sysmon category by volume, so most deployments that do run Sysmon explicitly exclude or throttle it in their config — on a host without Sysmon, or one that filters EventID 7, this rule returns nothing, which reads as quiet rather than as the blind spot it actually is. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0293, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceImageLoadEvents| where ((InitiatingProcessFolderPath endswith "\\AzureADConnectAuthenticationAgentService.exe" or InitiatingProcessFolderPath endswith "\\miiserver.exe" or InitiatingProcessFolderPath endswith "\\Microsoft.IdentityServer.ServiceHost.exe") and Signed =~ "false")

Splunk · SPL

Run this as a search.

index=* ((Image="*\\AzureADConnectAuthenticationAgentService.exe" OR Image="*\\miiserver.exe" OR Image="*\\Microsoft.IdentityServer.ServiceHost.exe") AND Signed="false")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\azureadconnectauthenticationagentservice.exe" OR TO_LOWER(process.executable) LIKE "*\\\\miiserver.exe" OR TO_LOWER(process.executable) LIKE "*\\\\microsoft.identityserver.servicehost.exe") AND TO_LOWER(file.code_signature.signed) == "false")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,image_load,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\AzureADConnectAuthenticationAgentService\.exe$|\\miiserver\.exe$|\\Microsoft\.IdentityServer\.ServiceHost\.exe$)</field>    <field name="Signed" type="pcre2">(?i)^false$</field>    <description>Unsigned module loaded into a hybrid identity agent process</description>    <mitre>      <id>T1556.007</id>    </mitre>  </rule></group>

At a glance

Logsource: image_load / windows
Level: medium
Category: account_manipulation
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 29bb5834-24dc-45e6-89e0-d13c4c6fb82c

ATT&CKT1556.007

T1556.007Hybrid Identity

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonaccount manipulation

account manipulationAI draft — unreviewed

01 · What this rule detects

AN0814 names "injection or tampering of DLLs in hybrid identity agents (e.g., AzureADConnectAuthenticationAgentService)" as its Windows signal. This rule expresses that literally on Sysmon EventID 7 (image_load): an unsigned module loading into one of three specific hybrid-identity processes. Of those three, only AzureADConnectAuthenticationAgentService.exe — the Pass-Through Authentication agent — is MITRE's own named example. miiserver.exe (the Azure AD Connect sync engine, which brokers Password Hash Sync) and Microsoft.IdentityServer.ServiceHost.exe (the AD FS service host) are this rule's own additions, reasoned from the same attacker motive against a different process rather than sourced from the brief.

02 · Telemetry you need

{category: image_load, product: windows}. Sysmon is not installed by default, and image_load is the highest-volume Sysmon event category by count — most deployments that run Sysmon at all explicitly throttle or exclude EventID 7 in their config. On a host without Sysmon, or one filtering this category, the rule returns nothing, which reads as quiet but is actually the sensor never seeing the event class it depends on.

03 · How the logic works

Two selection blocks, ANDed: selection_process matches Image|endswith against the three process names above; selection_unsigned matches Signed: false. Image here is the host process the module is loading into — the process being tampered with — not the module itself, which is the correct field for this observable on EID 7. The scoping to three named processes, rather than a system-wide unsigned-load check, is what makes this a distinct rule rather than a re-tagged copy of this corpus's existing T1014 rule, which already uses Signed: false unscoped. The Signed: false field carries the same caveat documented against that T1014 rule: it is Sysmon's own signing-check result, and a genuinely Microsoft-signed module can still report unsigned if the load-time WinVerifyTrust catalog check cannot complete — most commonly on a host with no path to the certificate-revocation service. The registry/configuration half of AN0814, mapped to Security EventID 5136, is declined outright: MITRE's description names no concrete object class, attribute, or registry key the way this brief does for other 5136-based analytics elsewhere in the corpus (T1484's rule, for comparison, matches ObjectClass values groupPolicyContainer and trustedDomain by name), and this pipeline has no sourced knowledge of AD FS's own directory footprint to invent a selector honestly. MITRE's TimeWindow knob, correlating the module load with a later logon anomaly, is also not implemented — lib/sigma has no cross-event join.

04 · Common false positives

level: medium. The top false positive is specific to these processes: on air-gapped or firewalled Azure AD Connect and AD FS servers — which are frequently kept on restricted network segments — Sysmon's signature check cannot reach the revocation service, so genuinely Microsoft-signed modules routinely report Signed: false. This is the same known Sysmon caveat already documented against T1014, expected to recur specifically on these server roles. Second, third-party EDR, AV, or backup agents that inject their own instrumentation DLL into every long-running Windows service process, including whichever of the three is present, as normal agent behavior. Third, upgrade and patching windows for Azure AD Connect or AD FS, during which the installer can briefly load unsigned staging modules while replacing binaries in place.

05 · Detection maturity

tier_1: .** Machine-derived from a scaffold containing no query logic, never run against real image_load telemetry — every false positive above is reasoning about how these three processes behave, not measurement.
tier_2: means running with Sysmon EID 7 actually enabled on hybrid-identity servers, confirming the revocation-service pattern, and building the agent allowlist before this rule earns any weight beyond a lead to check.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Cross-reference Signed: false hits against whether the host has a working path to the revocation service before treating one as meaningful — on these specific server roles, that single check likely eliminates the largest false positive. Build an allowlist of the known security/backup agent DLLs seen loading into these processes in steady state, since that source repeats indefinitely. Bound alerting to outside known patch windows for the AD Connect/AD FS upgrade case. None of this substitutes for the 5136 correlation MITRE actually asks for — this rule is a companion signal, not the full analytic.

Declared by the author

Air-gapped or firewalled Azure AD Connect and AD FS servers with no outbound path to the Windows certificate-revocation service, where Sysmon's load-time signature check cannot complete and reports Signed: false for a genuinely Microsoft-signed module — the same known Sysmon caveat documented against this corpus's T1014 rule, and expected to be common on these specific servers since they are frequently kept on restricted network segments.
Third-party security, backup or monitoring agents (EDR, AV, backup software) that inject their own hooking or instrumentation DLL into every long-running Windows service process on the host, including whichever of these three happens to be installed, as part of normal agent operation.
Azure AD Connect or AD FS upgrade and patching windows, during which the installer briefly loads unsigned or differently-signed staging modules into the service process while replacing binaries in place.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1556.007, evaluated against their image_load events.

Share this rule

/u/siemphony/29bb5834-24dc-45e6-89e0-d13c4c6fb82c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@hana-kobayashi
28 Aug 2026
miiserver.exe and the AD FS service host are not in MITRE's example and I am glad they are here — a PTA-agent-only rule would miss the two processes an attacker in a hybrid estate actually reaches for. Marking them explicitly as the rule's own additions rather than MITRE's is the kind of bookkeeping that decides whether I can defend a detection to an auditor six months later.

Unsigned module loaded into a hybrid identity agent process

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it

1 thread