certain users or applications may create multiple service principals in a short period of time for legitimate purposes. filter as needed.

Techniques

T1136.003

Sample rules

O365 Multiple Service Principals Created by SP

source: splunk
technicques:
- T1136.003

Description

The following analytic identifies instances where a single service principal creates more than three unique OAuth applications within a 10-minute timeframe. It leverages O365 logs from the Unified Audit Log, focusing on the ‘Add service principal’ operation in the Office 365 Azure Active Directory environment. This activity is significant as it may indicate a compromised or malicious service principal attempting to expand control or access within the network. If confirmed malicious, this could lead to unauthorized access and potential lateral movement within the environment, posing a significant security risk.

Detection logic

`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service principal."  
| bucket span=10m _time 
| eval len=mvcount('Actor{}.ID') 
| eval userType = mvindex('Actor{}.ID',len-1) 
| search userType = "ServicePrincipal" 
| eval displayName = object 
| stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps by src_user 
| where unique_apps > 3 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_multiple_service_principals_created_by_sp_filter`

Azure AD Multiple Service Principals Created by User

source: splunk
technicques:
- T1136.003

Description

The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute timeframe in Azure AD. It detects this activity by monitoring the ‘Add service principal’ operation and aggregating data in 10-minute intervals. This behavior is significant as it may indicate an adversary rapidly creating multiple service principals to stage an attack or expand their foothold within the network. If confirmed malicious, this activity could allow attackers to establish persistence, escalate privileges, or access sensitive information within the Azure environment.

Detection logic

`azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.user.id=* 
| rename properties.* as * 
| bucket span=10m _time 
| rename targetResources{}.displayName as displayName 
| stats min(_time) as firstTime max(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps by src_user 
| where unique_apps > 3 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `azure_ad_multiple_service_principals_created_by_user_filter`

O365 Multiple Service Principals Created by User

source: splunk
technicques:
- T1136.003

Description

The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute window in the Office 365 environment. It leverages O365 logs from the Unified Audit Log, focusing on the ‘Add service principal’ operation in Azure Active Directory. This activity is significant as it may indicate a compromised user account or unauthorized actions, potentially leading to broader network infiltration or privilege escalation. If confirmed malicious, this behavior could allow attackers to gain persistent access, escalate privileges, or exfiltrate sensitive information.

Detection logic

`o365_management_activity`  Workload=AzureActiveDirectory Operation="Add service principal."  
| bucket span=10m _time 
| eval len=mvcount('Actor{}.ID') 
| eval userType = mvindex('Actor{}.ID',len-1) 
| search userType = "User" 
| eval displayName = object 
| stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps by src_user 
| where unique_apps > 3 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_multiple_service_principals_created_by_user_filter`

Azure AD Multiple Service Principals Created by SP

source: splunk
technicques:
- T1136.003

Description

The following analytic detects when a single service principal in Azure AD creates more than three unique OAuth applications within a 10-minute span. It leverages Azure AD audit logs, specifically monitoring the ‘Add service principal’ operation initiated by service principals. This behavior is significant as it may indicate an attacker using a compromised or malicious service principal to rapidly establish multiple service principals, potentially staging an attack. If confirmed malicious, this activity could facilitate network infiltration or expansion, allowing the attacker to gain unauthorized access and persist within the environment.

Detection logic

`azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.app.appId=* 
| rename properties.* as * 
| bucket span=10m _time 
| rename targetResources{}.displayName as displayName 
| rename targetResources{}.type as type 
| rename initiatedBy.app.displayName as src_user 
| stats min(_time) as firstTime max(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps by src_user 
| where unique_apps > 3 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `azure_ad_multiple_service_principals_created_by_sp_filter`