KQL Search

id: 6062fcdc-6377-4e24-8673-465a7910c404
name: Unauthorized Federated Credential Added to Managed Identity
version: 1.0.0
kind: Scheduled
description: |-
  Detected the addition of an unauthorized Federated Identity Credential to a User Assigned Managed Identity.

  The activity involved configuring a Managed Identity to trust a specific external repository or organization that was not on the approved allow-list.

  This configuration established a potential backdoor, allowing:
  * Persistence: External workflows (e.g., GitHub Actions) from the unauthorized organization (AttackerOrg) were authorized to exchange their OIDC tokens for valid Azure Access Tokens.
  * Privilege Escalation: An external actor effectively gained the permissions associated with the internal Managed Identity without requiring a password or secret.
  * Defense Evasion: The actor utilized legitimate cloud federation protocols to bypass traditional credential monitoring.
severity: Medium
queryFrequency: 10m
queryPeriod: 14m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
- DefenseEvasion
- LateralMovement
relevantTechniques:
- T1098.001
- T1484.002
- T1550.001
- T1078.004
query: |-
  let allowedRepos = dynamic(["REPLACE_WITH_YOUR_ALLOWED_REPOSITORIES"]);
  AzureActivity
  | where OperationNameValue =~ "MICROSOFT.MANAGEDIDENTITY/USERASSIGNEDIDENTITIES/FEDERATEDIDENTITYCREDENTIALS/WRITE"
  | where ActivityStatusValue =~ "Success"
  | extend UMIName = tostring(split(tostring(Properties_d.resource), '/')[0])
  | extend FederatedCredentialName = tostring(split(tostring(Properties_d.resource), '/')[0])
  | extend UniqueTokenIdentifier = tostring(parse_json(Claims).uti)
  | project
      TimeGenerated,
      UMIName,
      FederatedCredentialName,
      Caller,
      CallerIpAddress,
      UniqueTokenIdentifier,
      _ResourceId
  | join kind=inner (AuditLogs
      | where OperationName == "Update service principal"
      | where TargetResources has "FederatedIdentityCredentials"
      | mv-expand TargetResources to typeof(dynamic)
      | extend UMIName = tostring(TargetResources.displayName)
      | project UMIName, TargetResources)
      on UMIName
  | extend modifiedProperties = TargetResources.modifiedProperties
  | mv-apply ModifiedProperty = modifiedProperties to typeof(dynamic) on (where ModifiedProperty.displayName == "FederatedIdentityCredentials")
  | extend NewCredentials = todynamic(tostring(ModifiedProperty.newValue))
  | mv-expand NewCredential = NewCredentials to typeof(dynamic)
  // Extract the attacker organization name and repository name
  | extend AttackerOrg = replace_regex(tostring(NewCredential.Subject), '^repo:(.*?)/.*$', @'\1')
  | extend AttackerRepo = replace_regex(tostring(NewCredential.Subject), '^repo:(.*?)/(.*?):.*$', @'\2')
  | where AttackerOrg !in (allowedRepos)
  | project-away TargetResources, modifiedProperties, ModifiedProperty, NewCredentials, UMIName1
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: AllEntities
    groupByEntities:
    - IP
    - Account
    - AzureResource
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  AttackerOrg: AttackerOrg
  AttackerRepo: AttackerRepo
  uti: UniqueTokenIdentifier
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: CallerIpAddress
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: Caller
- entityType: AzureResource
  fieldMappings:
  - identifier: ResourceId
    columnName: _ResourceId
suppressionDuration: 5h