[metadata]
creation_date = "2020/12/14"
maturity = "production"
updated_date = "2020/12/15"

[rule]
author = ["Elastic"]
description = """
Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret
string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application
and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an
environment.
"""
false_positives = [
    """
    Application credential additions may be done by a system or network administrator. Verify whether the username,
    hostname, and/or resource name should be making changes in your environment. Application credential additions from
    unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted
    from the rule.
    """,
]
from = "now-25m"
index = ["filebeat-*", "logs-azure*"]
language = "kuery"
license = "Elastic License"
name = "Azure Application Credential Modification"
note = "The Azure Fleet Integration or Filebeat module must be enabled to use this rule."
references = [
    "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/",
]
risk_score = 47
rule_id = "1a36cace-11a7-43a8-9a10-b497c5a02cd3"
severity = "medium"
tags = ["Elastic", "Cloud", "Azure", "Continuous Monitoring", "SecOps", "Identity and Access"]
type = "query"

query = '''
event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Update application - Certificates and secrets management" and event.outcome:(success or Success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
