Azure Service Principal Sign-In Followed by Arc Cluster Credential Access

Description

Detects when a service principal authenticates to Microsoft Entra ID and then lists credentials for an Azure Arc-connected Kubernetes cluster within a short time window. The `listClusterUserCredential` action retrieves tokens that enable kubectl access through the Arc Cluster Connect proxy. This sequence (service principal sign-in followed by Arc credential retrieval), represents the exact attack chain used by adversaries with stolen service principal secrets to establish a proxy tunnel into Kubernetes clusters. Service principals that authenticate externally (as opposed to managed identities) and immediately access Arc cluster credentials warrant investigation, particularly when the sign-in originates from an unexpected location or ASN.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
Log source category: event_index

Known benign triggers

Administrators using service principal credentials to manage Arc-connected clusters during maintenance windows may trigger this rule. Correlate with change management records.
CI/CD pipelines that authenticate as a service principal and then access Arc clusters as part of deployment workflows will trigger this rule. Identify and exclude known automation service principal app IDs.

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
learn.microsoft.com/en-us/azure/azure-arc/kubernetes/cluster-connect	Product documentation	3
learn.microsoft.com/en-us/cli/azure/connectedk8s#az-connectedk8s-proxy	Product documentation	2
learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins	Product documentation	6from 2 sources
www.ibm.com/think/x-force/identifying-abusing-azure-arc-for-hybrid-escalation-persistence	Unclassified	3
www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/	Threat report	13

Detection rules

Azure Service Principal Sign-In Followed by Arc Cluster Credential Access

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules