Azure Application Credential Modification

 1[metadata]
 2creation_date = "2020/12/14"
 3integration = ["azure"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret
11string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application
12and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an
13environment.
14"""
15false_positives = [
16    """
17    Application credential additions may be done by a system or network administrator. Verify whether the username,
18    hostname, and/or resource name should be making changes in your environment. Application credential additions from
19    unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted
20    from the rule.
21    """,
22]
23from = "now-25m"
24index = ["filebeat-*", "logs-azure*"]
25language = "kuery"
26license = "Elastic License v2"
27name = "Azure Application Credential Modification"
28note = """## Setup
29
30The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
31references = [
32    "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/",
33]
34risk_score = 47
35rule_id = "1a36cace-11a7-43a8-9a10-b497c5a02cd3"
36severity = "medium"
37tags = [
38    "Domain: Cloud",
39    "Data Source: Azure",
40    "Use Case: Identity and Access Audit",
41    "Tactic: Defense Evasion",
42]
43timestamp_override = "event.ingested"
44type = "query"
45
46query = '''
47event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Update application - Certificates and secrets management" and event.outcome:(success or Success)
48'''
49
50
51[[rule.threat]]
52framework = "MITRE ATT&CK"
53[[rule.threat.technique]]
54id = "T1550"
55name = "Use Alternate Authentication Material"
56reference = "https://attack.mitre.org/techniques/T1550/"
57[[rule.threat.technique.subtechnique]]
58id = "T1550.001"
59name = "Application Access Token"
60reference = "https://attack.mitre.org/techniques/T1550/001/"
61
62
63
64[rule.threat.tactic]
65id = "TA0005"
66name = "Defense Evasion"
67reference = "https://attack.mitre.org/tactics/TA0005/"