Azure Application Credential Modification

 1[metadata]
 2creation_date = "2020/12/14"
 3integration = ["azure"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret
13string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application
14and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an
15environment.
16"""
17false_positives = [
18    """
19    Application credential additions may be done by a system or network administrator. Verify whether the username,
20    hostname, and/or resource name should be making changes in your environment. Application credential additions from
21    unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted
22    from the rule.
23    """,
24]
25from = "now-25m"
26index = ["filebeat-*", "logs-azure*"]
27language = "kuery"
28license = "Elastic License v2"
29name = "Azure Application Credential Modification"
30note = """## Setup
31
32The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
33references = [
34    "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/",
35]
36risk_score = 47
37rule_id = "1a36cace-11a7-43a8-9a10-b497c5a02cd3"
38severity = "medium"
39tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Identity and Access Audit", "Tactic: Defense Evasion"]
40timestamp_override = "event.ingested"
41type = "query"
42
43query = '''
44event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Update application - Certificates and secrets management" and event.outcome:(success or Success)
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1550"
52name = "Use Alternate Authentication Material"
53reference = "https://attack.mitre.org/techniques/T1550/"
54[[rule.threat.technique.subtechnique]]
55id = "T1550.001"
56name = "Application Access Token"
57reference = "https://attack.mitre.org/techniques/T1550/001/"
58
59
60
61[rule.threat.tactic]
62id = "TA0005"
63name = "Defense Evasion"
64reference = "https://attack.mitre.org/tactics/TA0005/"