LoFP LoFP / service principal credential additions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. credential additions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

Techniques

Sample rules

Microsoft Entra ID Service Principal Credentials Added by Rare User

Description

Identifies when new Service Principal credentials have been added in Microsoft Entra ID. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements.

Detection logic

event.dataset: "azure.auditlogs"
    and azure.auditlogs.operation_name:"Add service principal credentials"
    and event.outcome: "success"