KQL Search

id: 79942a71-35af-40a0-9aaf-e79d77517d18
name: Service Principal Adds Client Secret to Target Application
version: 1.0.0
kind: Scheduled
description: |-
  This alert detects when an Azure AD Service Principal (non-human identity) creates or adds a new password credential (Client Secret) to a target Application or Service Principal.

  While automated rotation of credentials by management tools (like Terraform, Vault, or DevOps pipelines) is a legitimate use case, this behavior is also a common persistence and privilege escalation technique. An attacker who has compromised a Service Principal with Application.ReadWrite.All (or similar permissions) may inject a new secret into a highly privileged target application to hijack its identity and access resources.
severity: Medium
queryFrequency: 10m
queryPeriod: 12h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
relevantTechniques:
- T1098.001
query: |-
  AuditLogs
  | where TimeGenerated > ago(20m)
  | where OperationName has_all ("Update application", "Certificates and secrets management")
  | where TargetResources has "KeyType=Password"
  | extend InitiatedByServicePrincipalId = tostring(parse_json(tostring(InitiatedBy.app)).servicePrincipalId)
  | extend InitiatedByServicePrincipalDisplayName = tostring(parse_json(tostring(InitiatedBy.app)).displayName)
  | where isnotempty(InitiatedByServicePrincipalId)
  | mv-expand TargetResources to typeof(dynamic)
  | extend TargetServicePrincipalName = tostring(TargetResources.displayName)
  | extend TargetServicePrincipalId = tostring(TargetResources.id)
  | extend modifiedProperties = TargetResources.modifiedProperties
  | mv-apply ModifiedProperty = modifiedProperties to typeof(dynamic) on (where ModifiedProperty.displayName == "KeyDescription")
  | extend NewCredentials = todynamic(tostring(ModifiedProperty.newValue))
  | mv-expand NewCredential = NewCredentials to typeof(string)
  | extend NewCredential = trim(@'[\[\]]', NewCredential)
  | parse-kv NewCredential as (KeyIdentifier: string, KeyType: string, KeyUsage: string, KeyDisplayName: string) with (pair_delimiter=',', kv_delimiter='=')
  | project-away NewCredentials, NewCredential, modifiedProperties, ModifiedProperty, KeyUsage
  | project-reorder
      TimeGenerated,
      OperationName,
      InitiatedByServicePrincipalDisplayName,
      InitiatedByServicePrincipalId,
      TargetServicePrincipalName,
      TargetServicePrincipalId,
      KeyType,
      KeyIdentifier
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: InitiatedByServicePrincipalDisplayName
suppressionDuration: 5h