Sunturai
Back to results
MediumSplunk security contentSteven Dick

O365 Privileged Role Assigned To Service Principal

The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions…

Description

The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals. This detection leverages the O365 Universal Audit Log data source.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderOffice SuiteSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
office_365_universal_audit_log

Known benign triggers

  • Administrators may legitimately assign the privileged roles to Service Principals as part of administrative tasks. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice