KQL Search

id: 9b1a0010-1010-4110-9110-aadprov00010
name: Provisioning ServicePrincipal Credential Added or Rotated
version: 1.0.0
kind: Scheduled
description: |
  Detects new client certificates or client secrets added to a service
  principal that has been observed performing provisioning operations in the
  last 30 days. Per Cloud-Architekt T1098.001 mapping, adding credentials
  ("Additional Cloud Credentials") to a provisioning SP is a high-value
  persistence primitive: the attacker keeps using legitimate provisioning
  flows but with credentials only they hold.
  Triggers on `Add service principal credentials` / `Update application -
  Certificates and secrets management` audit events whose target SP intersects
  with the active provisioning-SP inventory.
  MITRE ATT&CK: T1098.001 (Account Manipulation: Additional Cloud
  Credentials), T1550.001 (Use Alternate Authentication Material:
  Application Access Token).
severity: High
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
      - AADProvisioningLogs
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - PrivilegeEscalation
  - DefenseEvasion
relevantTechniques:
  - T1098
  - T1550
query: |
  let ProvisioningSPs =
      AADProvisioningLogs
      | where TimeGenerated > ago(14d)
      | extend SPId   = tostring(parse_json(ServicePrincipal).Id),
               SPName = tostring(parse_json(ServicePrincipal).Name)
      | summarize Events = count() by SPId, SPName
      | where Events >= 10
      | project SPId, SPName;
  AuditLogs
  | extend IPAddress = tostring(InitiatedBy.user.ipAddress)
  | invoke ExcludeAllowlistedIPs()
  | where TimeGenerated > ago(1h)
  | where OperationName has_any (
        "Add service principal credentials",
        "Update application - Certificates and secrets management",
        "Update application",
        "Add owner to service principal",
        "Update service principal"
    )
  | mv-expand TargetResources
  | extend TargetSPId   = tostring(TargetResources.id),
           TargetSPName = tostring(TargetResources.displayName)
  | extend Actor    = coalesce(tostring(InitiatedBy.user.userPrincipalName),
                                tostring(InitiatedBy.app.displayName))
  | extend SourceIP = tostring(InitiatedBy.user.ipAddress)
  | extend ModProps = tostring(TargetResources.modifiedProperties)
  | where ModProps has_any (
        "KeyDescription","PasswordCredentials","KeyCredentials",
        "keyDescription","passwordCredentials","keyCredentials"
    )
  | join kind=inner (ProvisioningSPs) on $left.TargetSPId == $right.SPId
  | project TimeGenerated, OperationName, Actor, SourceIP,
            TargetSPName, TargetSPId, ModProps, Result
  | order by TimeGenerated desc
entityMappings:
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: TargetSPName
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Actor
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
customDetails:
  OperationName: OperationName
  TargetSPName: TargetSPName
  Actor: Actor
alertDetailsOverride:
  alertDisplayNameFormat: "Credentials added to provisioning SP {{TargetSPName}} by {{Actor}}"
  alertDescriptionFormat: "{{Actor}} added/rotated credentials on provisioning ServicePrincipal {{TargetSPName}}. Validate against approved certificate-rotation change ticket."
  alertSeverityColumnName: ""
  alertTacticsColumnName: ""
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT24H
    matchingMethod: AnyAlert
    groupByEntities:
      - CloudApplication
    groupByAlertDetails: []
    groupByCustomDetails: []