Try in Splunk Security Cloud


The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. Attackers who are looking to escalate their privileges by leveraging a Service Principals permissions may also add a new owner.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2022-08-30
  • Author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
  • ID: 7ddf2084-6cf3-4a44-be83-474f7b73c701




ID Technique Tactic
T1098 Account Manipulation Persistence, Privilege Escalation
Kill Chain Phase
  • Installation
  • Exploitation
  • DE.CM
  • CIS 10
 `azuread` operationName="Add owner to application" 
| rename properties.* as * 
| rename initiatedBy.user.userPrincipalName as initiatedBy 
| rename targetResources{}.userPrincipalName as newOwner 
| rename targetResources{}.modifiedProperties{}.newValue as displayName 
| eval displayName = mvindex(displayName,1) 
| where initiatedBy!=newOwner 
| stats values(displayName) as displayName by _time, initiatedBy, result, operationName, newOwner 
| `azure_ad_service_principal_owner_added_filter`


The SPL above uses the following Macros:

:information_source: azure_ad_service_principal_owner_added_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • operationName
  • properties.initiatedBy.user.userPrincipalName
  • properties.targetResources{}.userPrincipalName
  • properties.targetResources{}.modifiedProperties{}.newValue
  • properties.result

How To Implement

You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase( You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the AuditLogs log category.

Known False Positives

Administrator may legitimately add new owners for Service Principals. Filter as needed.

Associated Analytic Story


Risk Score Impact Confidence Message
54.0 60 90 A new owner was added for service principal $displayName$ by $initiatedBy$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.


Test Dataset

Replay any dataset to Splunk Enterprise by using our tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2