Azure Service Principal Created

 1title: Azure Service Principal Created
 2id: 0ddcff6d-d262-40b0-804b-80eb592de8e3
 3status: test
 4description: Identifies when a service principal is created in Azure.
 5references:
 6    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy
 7author: Austin Songer @austinsonger
 8date: 2021-09-02
 9modified: 2022-10-09
10tags:
11    - attack.defense-evasion
12logsource:
13    product: azure
14    service: activitylogs
15detection:
16    selection:
17        properties.message: 'Add service principal'
18    condition: selection
19falsepositives:
20    - Service principal being created may be performed by a system administrator.
21    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
22    - Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
23level: medium