Azure Active Directory Hybrid Health AD FS Service Delete (48739819-8230-4ee3-a8ea-e0289d1fb0ff)
This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.