Merge pull request #3049 from MarkMorow/markmorow

Create azure_app_credential_added.yml
2022-05-27 07:01:39 +02:00
parent 61ee06897a 32e6a82cf2
commit 9c0e7cf3e8
2 changed files with 26 additions and 0 deletions
@@ -57,6 +57,9 @@ local_settings.py
 instance/
 .webassets-cache

+# MacOS Finder
+.DS_Store
+
 # Scrapy stuff:
 .scrapy

@@ -0,0 +1,23 @@
+title: Added Credentials to Existing Application
+id: cbb67ecc-fb70-4467-9350-c910bdf7c628
+description: Detects when a new credential is added to an existing applcation. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.  
+author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
+date: 2022/05/26
+references:
+  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-credentials
+logsource:
+  product: azure
+  service: auditlogs
+detection:
+  selection:
+    properties.message: 
+      - Update Application-Certificates and secrets management
+      - Update Service principal/Update Application
+  condition: selection
+falsepositives:
+  - When credentials are added/removed as part of the normal working hours/workflows
+level: high
+status: experimental
+tags: 
+  - attack.t1098
+  - attack.persistence