O365 Added Service Principal
Description
This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
- Type: TTP
-
Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Last Updated: 2022-02-03
- Author: Rod Soto, Splunk
- ID: 1668812a-6047-11eb-ae93-0242ac130002
Annotations
Kill Chain Phase
- Exploitation
NIST
CIS20
CVE
Search
1
2
3
4
5
`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service principal credentials."
| stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress Operation
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_added_service_principal_filter`
Macros
The SPL above uses the following Macros:
Note that o365_added_service_principal_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Required field
- _time
- Workload
- signature
- Actor{}.ID
- ModifiedProperties{}.Name
- ModifiedProperties{}.NewValue
- Target{}.ID
- ActorIpAddress
How To Implement
You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
Known False Positives
The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
Associated Analytic story
RBA
Risk Score | Impact | Confidence | Message |
---|---|---|---|
42.0 | 70 | 60 | User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$ |
Reference
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.sygnia.co/golden-saml-advisory
Test Dataset
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range
source | version: 1