Potential SSH Tunnel to AAD Connect Host

id: 7f52bc1d-138e-4a02-af25-a04dbea85646
name: Potential SSH Tunnel to AAD Connect Host
description: |
  'Azure AD Connect (AAD Connect) is a critical service that handles connections between on-premise Active Directory and Azure AD.
  Due to the critical nature of AAD Connect threat actors may attempt to compromise the service in order to access credentials.
  This query looks for SSH connections to host that appear to run AAD Connect. The results should be reviewed to determine if the 
  SSH connection is legitimate.'
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
    - DeviceInfo
tactics:
  - Persistence
relevantTechniques:
  - T1133
query: |
  DeviceInfo
  | where LoggedOnUsers has "MSOL_"
  | summarize by DeviceName, PublicIP
  | join kind=inner (_Im_NetworkSession
  | where NetworkApplicationProtocol =~ "ssh") on $left.PublicIP == $right.DstIpAddr
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: PublicIP
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceName