defense_evasion_azure_application_credential_modification.toml

[metadata]
creation_date = "2020/12/14"
integration = ["azure"]
maturity = "production"
updated_date = "2024/05/21"

[rule]
author = ["Elastic"]
description = """
Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret
string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application
and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an
environment.
"""
false_positives = [
    """
    Application credential additions may be done by a system or network administrator. Verify whether the username,
    hostname, and/or resource name should be making changes in your environment. Application credential additions from
    unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted
    from the rule.
    """,
]
from = "now-25m"
index = ["filebeat-*", "logs-azure*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Application Credential Modification"
note = """## Setup

The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/",
]
risk_score = 47
rule_id = "1a36cace-11a7-43a8-9a10-b497c5a02cd3"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Use Case: Identity and Access Audit",
    "Tactic: Defense Evasion",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Update application - Certificates and secrets management" and event.outcome:(success or Success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"