← Back to SOC feed Coverage →

Potential SSH Tunnel to AAD Connect Host

kql MEDIUM Azure-Sentinel
T1133
credential-thefthuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-06-03T11:00:00Z · Confidence: medium

Hunt Hypothesis

A potential SSH tunnel to an AAD Connect host indicates an adversary may be establishing covert access to exfiltrate data or pivot within the network. SOC teams should proactively hunt for this behavior to detect and mitigate unauthorized access to a critical identity service.

KQL Query

DeviceInfo
| where LoggedOnUsers has "MSOL_"
| summarize by DeviceName, PublicIP
| join kind=inner (_Im_NetworkSession
| where NetworkApplicationProtocol =~ "ssh") on $left.PublicIP == $right.DstIpAddr

Analytic Rule Definition

id: 7f52bc1d-138e-4a02-af25-a04dbea85646
name: Potential SSH Tunnel to AAD Connect Host
description: |
  'Azure AD Connect (AAD Connect) is a critical service that handles connections between on-premise Active Directory and Azure AD.
  Due to the critical nature of AAD Connect threat actors may attempt to compromise the service in order to access credentials.
  This query looks for SSH connections to host that appear to run AAD Connect. The results should be reviewed to determine if the 
  SSH connection is legitimate.'
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
    - DeviceInfo
tactics:
  - Persistence
relevantTechniques:
  - T1133
query: |
  DeviceInfo
  | where LoggedOnUsers has "MSOL_"
  | summarize by DeviceName, PublicIP
  | join kind=inner (_Im_NetworkSession
  | where NetworkApplicationProtocol =~ "ssh") on $left.PublicIP == $right.DstIpAddr
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: PublicIP
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceName

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/MultipleDataSources/PotentialSSHTunneltoAADConnectHost.yaml