Sunturai
Back to results
MediumSplunk security contentMauricio Velazco +2

Azure AD Service Principal New Client Credentials

The following analytic detects the addition of new credentials to Service Principals and Applications in Azure AD. It leverages Azure AD AuditLogs, specifically monitoring the "Update application*Certificates and…

Description

The following analytic detects the addition of new credentials to Service Principals and Applications in Azure AD. It leverages Azure AD AuditLogs, specifically monitoring the "Update application*Certificates and secrets management" operation. This activity is significant as it may indicate an adversary attempting to maintain persistent access or escalate privileges within the Azure environment. If confirmed malicious, attackers could use these new credentials to log in as the service principal, potentially compromising sensitive accounts and resources, leading to unauthorized access and control over the Azure environment.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
azure_active_directory

Known benign triggers

  • Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice