Analytics Story: Azure Active Directory Persistence

Updated Date: 2026-05-13 ID: dca983db-6334-4a0d-be32-80611ca1396c Author: Mauricio Velazco, Splunk Product: Splunk Enterprise Security

Description

Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.

Why it matters

Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
O365 Application Available To Other Tenants	Additional Cloud Roles	TTP
Windows Azure PowerShell Module Installation Via PowerShell Script	Cloud Services, Cloud Groups, Valid Accounts, Account Manipulation, Cloud Account	Anomaly
Azure AD Multiple Service Principals Created by SP	Cloud Account	Anomaly
O365 Privileged Role Assigned	Additional Cloud Roles	TTP
Azure AD Privileged Role Assigned	Additional Cloud Roles	TTP
Azure AD New Custom Domain Added	Trust Modification	TTP
Azure AD Service Principal Owner Added	Account Manipulation	TTP
Azure AD Multiple Service Principals Created by User	Cloud Account	Anomaly
O365 SharePoint Allowed Domains Policy Changed	Cloud Account	TTP
Windows Multiple Accounts Deleted	Valid Accounts, Account Manipulation	TTP
Azure AD PIM Role Assignment Activated	Additional Cloud Roles	TTP
Azure Automation Account Created	Cloud Account	TTP
Azure AD Service Principal Created	Cloud Account	TTP
Azure AD User Enabled And Password Reset	Account Manipulation	TTP
O365 SharePoint Malware Detection	Malicious File	TTP
Windows Multiple Accounts Disabled	Valid Accounts, Account Manipulation	TTP
Azure Automation Runbook Created	Cloud Account	TTP
Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script	Web Protocols, Valid Accounts, Exploitation for Credential Access, Domain Trust Discovery	TTP
Azure AD Service Principal New Client Credentials	Additional Cloud Credentials	TTP
Windows Multiple Account Passwords Changed	Valid Accounts, Account Manipulation	TTP
Azure AD New Federated Domain Added	Trust Modification	TTP
Azure Runbook Webhook Created	Cloud Accounts	TTP
Azure AD Global Administrator Role Assigned	Additional Cloud Roles	TTP
Azure AD FullAccessAsApp Permission Assigned	Additional Email Delegate Permissions, Additional Cloud Roles	TTP
Azure AD User ImmutableId Attribute Updated	Account Manipulation	TTP
O365 External Guest User Invited	Cloud Account	TTP
Azure AD New MFA Method Registered	Device Registration	TTP
Azure AD PIM Role Assigned	Additional Cloud Roles	TTP
O365 Cross-Tenant Access Change	Trust Modification	TTP
Azure AD Tenant Wide Admin Consent Granted	Additional Cloud Roles	TTP
Azure AD External Guest User Invited	Cloud Account	TTP
Azure AD Privileged Graph API Permission Assigned	Security Account Manager	TTP
Windows Entra User Management Via Azure CLI	Cloud Accounts, Account Manipulation, Create Account	Anomaly
O365 External Identity Policy Changed	Cloud Account	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Office 365 Universal Audit Log	Other	`o365:management:activity`	`o365`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Azure Active Directory Add service principal	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Add member to role	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Add unverified domain	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Add owner to application	Azure	`azure:monitor:aad`	`Azure AD`
Windows Event Log Security 4726	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Azure Active Directory	Azure	`azure:monitor:aad`	`Azure AD`
Azure Audit Create or Update an Azure Automation account	Azure	`mscs:azure:audit`	`mscs:azure:audit`
Azure Active Directory Reset password (by admin)	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Update user	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Enable account	Azure	`azure:monitor:aad`	`Azure AD`
Windows Event Log Security 4725	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Azure Audit Create or Update an Azure Automation Runbook	Azure	`mscs:azure:audit`	`mscs:azure:audit`
Windows Event Log Security 4724	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Azure Active Directory Set domain authentication	Azure	`azure:monitor:aad`	`Azure AD`
Azure Audit Create or Update an Azure Automation webhook	Azure	`mscs:azure:audit`	`mscs:azure:audit`
Azure Active Directory Update application	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Consent to application	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Invite external user	Azure	`azure:monitor:aad`	`Azure AD`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 3