Azure AD Service Principal Owner Added
Description
The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. Attackers who are looking to escalate their privileges by leveraging a Service Principals permissions may also add a new owner.
- Type: TTP
-
Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Last Updated: 2022-08-30
- Author: Mauricio Velazco, Splunk
- ID: 7ddf2084-6cf3-4a44-be83-474f7b73c701
Annotations
Kill Chain Phase
- Installation
NIST
- DE.CM
CIS20
- CIS 10
CVE
Search
1
2
3
4
5
6
7
8
9
`azuread` body.operationName="Add owner to application"
| rename body.properties.* as *
| rename initiatedBy.user.userPrincipalName as initiatedBy
| rename targetResources{}.userPrincipalName as newOwner
| rename targetResources{}.modifiedProperties{}.newValue as displayName
| eval displayName = mvindex(displayName,1)
| where initiatedBy!=newOwner
| stats values(displayName) by _time, initiatedBy, result, body.operationName, newOwner
| `azure_ad_service_principal_owner_added_filter`
Macros
The SPL above uses the following Macros:
azure_ad_service_principal_owner_added_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Required fields
List of fields required to use this analytic.
- _time
- body.operationName
- body.properties.initiatedBy.user.userPrincipalName
- body.properties.targetResources{}.userPrincipalName
- body.properties.targetResources{}.modifiedProperties{}.newValue
- body.propertiesresult
How To Implement
You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
Known False Positives
Administrator may legitimately add new owners for Service Principals. Filter as needed.
Associated Analytic Story
RBA
Risk Score | Impact | Confidence | Message |
---|---|---|---|
54.0 | 60 | 90 | A new owner was added for service principal $displayName$ by $initiatedBy$ |
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
Reference
Test Dataset
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
source | version: 2