Detect Additional Cloud Credentials in Google Chronicle

rule T1098_001_Additional_Cloud_Credentials {
  meta:
    author          = "Detection Engineering"
    description     = "Detects addition of credentials to Azure/Entra ID service principals and applications (T1098.001). Covers service principal credential additions, certificate and secret management, app password creation for MFA bypass, and ownership changes."
    mitre_attack_tactic    = "Persistence"
    mitre_attack_technique = "T1098.001"
    severity        = "HIGH"
    confidence      = "HIGH"
    version         = "1.0"
    created         = "2026-04-13"

  events:
    $e.metadata.log_type = "AZURE_AD"
    $e.metadata.product_event_type in (
      "Add service principal credentials",
      "Update application \u2013 Certificates and secrets management",
      "Add application",
      "Update service principal",
      "Add owner to application",
      "Add app role assignment to service principal",
      "Create application password for user",
      "Update application password for user",
      "Delete application password for user"
    )
    // Include both explicit ALLOW and events with no block action (missing result = likely success)
    not $e.security_result.action = "BLOCK"
    $e.principal.user.email_addresses = $initiating_upn

  match:
    $initiating_upn over 1h

  outcome:
    $event_count              = count_distinct($e.metadata.id)
    $operations               = array_distinct($e.metadata.product_event_type)
    $target_resources         = array_distinct($e.target.resource.name)
    $source_ips               = array_distinct($e.principal.ip)
    $is_mfa_bypass_risk       = max(if($e.metadata.product_event_type = "Create application password for user", 1, 0))
    $is_sp_credential_add     = max(if($e.metadata.product_event_type = "Add service principal credentials", 1, 0))
    $is_ownership_change      = max(if($e.metadata.product_event_type = "Add owner to application", 1, 0))

  condition:
    $e
}