certain users or applications may create multiple service principals in a short period of time for legitimate purposes. filter as needed.

Techniques

T1136.003

Sample rules

O365 Multiple Service Principals Created by User

source: splunk
technicques:
- T1136.003

Description

This detection is tailored to spot occurrences where a single user, rather than a service principal, creates more than three unique OAuth applications within a 10-minute window in the Office 365 environment. Utilizing O365 logs from the Unified Audit Log, it focuses on the ‘Add service principal’ operation in Azure Active Directory. The query segments events into 10-minute intervals, exclusively monitoring user activities. It calculates the number of distinct OAuth applications initiated by each user, providing SOC teams with essential data for identifying potential security threats. Such activity could suggest that a user account is either compromised or engaged in unauthorized activities, potentially setting the stage for broader network infiltration or privilege escalation. It’s important for security teams to adjust the threshold of three applications to fit their operational context.

Detection logic

`o365_management_activity`  Workload=AzureActiveDirectory Operation="Add service principal."  
| bucket span=10m _time 
| eval len=mvcount('Actor{}.ID') 
| eval userType = mvindex('Actor{}.ID',len-1) 
| search userType = "User" 
| eval displayName = object 
| stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps by src_user 
| where unique_apps > 3 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_multiple_service_principals_created_by_user_filter`

O365 Multiple Service Principals Created by SP

source: splunk
technicques:
- T1136.003

Description

This detection aims to identify instances where a single service principal creates more than three unique OAuth applications within a 10-minute timeframe, using O365 logs from the Unified Audit Log. The focus is on tracking the ‘Add service principal’ operation within the Office 365 Azure Active Directory environment. The query effectively buckets events in 10-minute intervals, specifically scrutinizing the actions of service principals. By quantifying the number of distinct OAuth applications each service principal establishes, the analytic provides critical insights for SOC teams into potentially anomalous or malicious activities. These activities could include a compromised or malicious service principal being used to create multiple service principals, which might be indicative of an attempt to expand control or access within the network. Security teams are advised to adapt the threshold of three applications to align with their typical operational baseline

Detection logic

`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service principal."  
| bucket span=10m _time 
| eval len=mvcount('Actor{}.ID') 
| eval userType = mvindex('Actor{}.ID',len-1) 
| search userType = "ServicePrincipal" 
| eval displayName = object 
| stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps by src_user 
| where unique_apps > 3 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_multiple_service_principals_created_by_sp_filter`

Azure AD Multiple Service Principals Created by User

source: splunk
technicques:
- T1136.003

Description

This detection focuses on identifying instances where a single user creates more than three unique OAuth applications within a 10-minute timeframe in Azure AD, a potential indicator of malicious activity. By monitoring the ‘Add service principal’ operation and aggregating the data with a 10-minute bucket span, it tracks the number of distinct OAuth applications created by each user. This analytic is crucial for SOC teams to detect possible staging of attacks, where an adversary might rapidly create multiple service principals as part of their infiltration or expansion strategy within the network. The threshold of three applications is set to flag unusual behavior, but security teams are advised to adjust this value to suit the normal operational patterns of their environment

Detection logic

 `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.user.id=* 
| rename properties.* as * 
| bucket span=10m _time 
| rename targetResources{}.displayName as displayName 
| stats min(_time) as firstTime max(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps by src_user 
| where unique_apps > 3 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `azure_ad_multiple_service_principals_created_by_user_filter`

Azure AD Multiple Service Principals Created by SP

source: splunk
technicques:
- T1136.003

Description

This detection identifies when a single service principal in Azure AD creates more than three unique OAuth applications within a 10-minute span, potentially signaling malicious activity. It monitors the ‘Add service principal’ operation, focusing on the activity of service principals rather than individual users. By aggregating the creation events over a 10-minute period, the analytic tracks how many distinct OAuth applications are created by each service principal. This is key for SOC teams to pinpoint potential attack staging, where an attacker might use a compromised or malicious service principal to rapidly establish multiple service principals, facilitating network infiltration or expansion. While the default threshold is set to trigger on more than three applications, security teams should adjust this to fit their specific environment’s norm

Detection logic

 `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.app.appId=* 
| rename properties.* as * 
| bucket span=10m _time 
| rename targetResources{}.displayName as displayName 
| rename targetResources{}.type as type 
| rename initiatedBy.app.displayName as src_user 
| stats min(_time) as firstTime max(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps by src_user 
| where unique_apps > 3 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `azure_ad_multiple_service_principals_created_by_sp_filter`