Sunturai
Back to results
InformationalSplunk security contentMauricio Velazco +1

O365 Multiple Service Principals Created by User

The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute window in the Office 365 environment. It leverages O365 logs from the Unified Audit…

Description

The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute window in the Office 365 environment. It leverages O365 logs from the Unified Audit Log, focusing on the 'Add service principal' operation in Azure Active Directory. This activity is significant as it may indicate a compromised user account or unauthorized actions, potentially leading to broader network infiltration or privilege escalation. If confirmed malicious, this behavior could allow attackers to gain persistent access, escalate privileges, or exfiltrate sensitive information.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderOffice SuiteSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
o365_add_service_principal

Known benign triggers

  • Certain users or applications may create multiple service principals in a short period of time for legitimate purposes. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice