KQL Search

// =========================================================================
// HQ-002: New Application Registration with Immediate Credential Addition
// =========================================================================
// Description : Joins app creation events with credential-add events within
//               a 5-minute window. Legitimate DevOps pipelines register apps
//               and add secrets, but so do ROADtools and MicroBurst when
//               setting up OAuth infrastructure for token abuse or persistence.
//               Review the actor and app display name for anomalies.
// MITRE ATT&CK: TA0003 Persistence
//               T1098.001 – Additional Cloud Credentials
// Tools       : ROADtools, MicroBurst, AADInternals, CloudKatana
// Severity    : Medium-High
// Data Source : AuditLogs (Azure Active Directory)
// =========================================================================

let Lookback       = 1d;
let CredWindow     = 5m;

let AppCreations = AuditLogs
| where TimeGenerated > ago(Lookback)
| where ActivityDisplayName in (
    "Add application",
    "Create application \u2013 Certificates and secrets management ")
| extend AppObjectId   = tostring(TargetResources[0].id)
| extend AppName       = tostring(TargetResources[0].displayName)
| extend CreatorUPN    = tostring(InitiatedBy.user.userPrincipalName)
| extend CreatorApp    = tostring(InitiatedBy.app.displayName)
| extend CreatorActor  = iff(isnotempty(CreatorUPN), CreatorUPN, CreatorApp)
| project CreatedAt = TimeGenerated, AppObjectId, AppName, CreatorActor, CreatorUPN, CreatorApp, CorrelationId;

let CredAdds = AuditLogs
| where TimeGenerated > ago(Lookback)
| where ActivityDisplayName in (
    "Update application \u2013 Certificates and secrets management ",
    "Create application \u2013 Certificates and secrets management ",
    "Add service principal credentials",
    "Update service principal")
| mv-expand Prop = TargetResources[0].modifiedProperties
| where tostring(Prop.displayName) has_any ("KeyCredentials","PasswordCredentials","Credential","Secret","Certificate")
| extend AppObjectId    = tostring(TargetResources[0].id)
| extend AppName        = tostring(TargetResources[0].displayName)
| extend CredActorUPN   = tostring(InitiatedBy.user.userPrincipalName)
| extend CredActorApp   = tostring(InitiatedBy.app.displayName)
| extend CredActor      = iff(isnotempty(CredActorUPN), CredActorUPN, CredActorApp)
| extend CredType       = tostring(Prop.displayName)
| project CredAddedAt = TimeGenerated, AppObjectId, AppName, CredActor, CredActorUPN, CredType;

AppCreations
| join kind=inner CredAdds on AppObjectId
| where CredAddedAt > CreatedAt
| where CredAddedAt <= CreatedAt + CredWindow
| extend MinutesBetween = datetime_diff('minute', CredAddedAt, CreatedAt)
| project
    AppName,
    AppObjectId,
    CreatedAt,
    CredAddedAt,
    MinutesBetween,
    CreatorActor,
    CredActor,
    CredType
| order by CreatedAt desc