Auditlogs Apporserviceprincipalcredential

KQL detection rule by ep3p · MIT

No description provided

let _ExpectedApps = toscalar(
    _GetWatchlist("Activity-ExpectedSignificantActivity")
    | where Activity == "AppServiceCredentialModification" and Notes has "[App]"
    | summarize make_list(ActorId)
);
AuditLogs
| where OperationName has_any ("Add application", "Add service principal", "Certificates and secrets management") // Capture "Add application", "Add service principal", "Add service principal credentials", and "Update application - Certificates and secrets management" events
// | where Result == "success"
| extend
    Initiator = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["displayName"]), tostring(InitiatedBy["user"]["userPrincipalName"])),
    InitiatorId = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["servicePrincipalId"]), tostring(InitiatedBy["user"]["id"])),
    IPAddress = tostring(InitiatedBy[tostring(bag_keys(InitiatedBy)[0])]["ipAddress"]),
    // Information about the target object
    TargetType = tostring(TargetResources[0].type),
    TargetDisplayName = tostring(TargetResources[0]["displayName"]),
    TargetId = tostring(TargetResources[0]["id"])
| where not(InitiatorId in (_ExpectedApps))
| mv-apply ModifiedProperty = TargetResources[0]["modifiedProperties"] on (
    summarize ModifiedProperties = make_bag(bag_pack(tostring(ModifiedProperty["displayName"]), pack("oldValue", trim(@'[\"\s]+', tostring(ModifiedProperty["oldValue"])), "newValue", trim(@'[\"\s]+', tostring(ModifiedProperty["newValue"])))))
    )
| where isnotempty(ModifiedProperties["KeyDescription"])
| extend
    AddedCredentials = set_difference(todynamic(tostring(ModifiedProperties["KeyDescription"]["newValue"])), todynamic(tostring(ModifiedProperties["KeyDescription"]["oldValue"]))),
    RemovedCredentials = set_difference(todynamic(tostring(ModifiedProperties["KeyDescription"]["oldValue"])), todynamic(tostring(ModifiedProperties["KeyDescription"]["newValue"])))
// | mv-expand AddedCredentials = iff(array_length(AddedCredentials) != 0, AddedCredentials, dynamic([""])) to typeof(string)
// | parse AddedCredentials with "[KeyIdentifier=" KeyIdentifier: string ",KeyType=" KeyType: string ",KeyUsage=" KeyUsage: string ",DisplayName=" KeyDisplayName: string "]"
| project
    TimeGenerated,
    LoggedByService,
    Category,
    AADOperationType,
    Initiator,
    IPAddress,
    OperationName,
    Result,
    ResultDescription,
    TargetType,
    TargetDisplayName,
    AddedCredentials,
    RemovedCredentials,
    TargetId,
    InitiatorId,
    AdditionalDetails,
    InitiatedBy,
    TargetResources,
    CorrelationId

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1735b155-6884-42f1-813d-06f880fe4965

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion