Detect Additional Cloud Credentials in Elastic Security
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. This includes adding credentials to Azure/Entra ID Service Principals and Applications (x509 keys and passwords), generating or importing SSH keys in AWS/GCP, creating AWS IAM access keys or login profiles, and adding app passwords to Entra ID user accounts to bypass MFA. These techniques allow persistent access even if the original compromised credentials are rotated.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1098 Account Manipulation
- Sub-technique
- T1098.001 Additional Cloud Credentials
- Canonical reference
- https://attack.mitre.org/techniques/T1098/001/
Elastic Detection Query
any where event.dataset == "azure.auditlogs"
and azure.auditlogs.operation_name in~ (
"Add service principal credentials",
"Update application – Certificates and secrets management",
"Add application",
"Update service principal",
"Add owner to application",
"Add app role assignment to service principal",
"Create application password for user",
"Update application password for user",
"Delete application password for user"
)
and (
azure.auditlogs.properties.result == "success"
or azure.auditlogs.properties.result == null
or azure.auditlogs.properties.result == ""
)
and (
azure.auditlogs.properties.initiated_by.user.user_principal_name != null
or azure.auditlogs.properties.initiated_by.app.display_name != null
)
| eval
initiating_upn = azure.auditlogs.properties.initiated_by.user.user_principal_name,
initiating_app = azure.auditlogs.properties.initiated_by.app.display_name,
initiating_ip = azure.auditlogs.properties.initiated_by.user.ip_address,
target_resource = azure.auditlogs.properties.target_resources.0.display_name,
target_type = azure.auditlogs.properties.target_resources.0.type,
correlation_id = azure.auditlogs.properties.correlation_id,
credential_type = case(
azure.auditlogs.operation_name like~ "*certificate*" or azure.auditlogs.operation_name like~ "*secret*", "Certificate_or_Secret",
azure.auditlogs.operation_name like~ "*password*", "AppPassword",
azure.auditlogs.operation_name like~ "*credentials*", "ServicePrincipalCredential",
"Other"
),
is_high_risk = case(
azure.auditlogs.operation_name == "Create application password for user", "MFA_Bypass_Risk",
azure.auditlogs.operation_name == "Add service principal credentials", "SP_Credential_Add",
azure.auditlogs.operation_name == "Add owner to application", "Ownership_Change",
"Low"
),
is_service_account = case(
azure.auditlogs.properties.initiated_by.user.user_principal_name like~ "*svc-*"
or azure.auditlogs.properties.initiated_by.user.user_principal_name like~ "*automation*"
or azure.auditlogs.properties.initiated_by.user.user_principal_name like~ "*pipeline*"
or azure.auditlogs.properties.initiated_by.user.user_principal_name like~ "*deploy*"
or azure.auditlogs.properties.initiated_by.user.user_principal_name like~ "*robot*", "Yes",
"No"
)Detects Azure/Entra ID service principal and application credential additions using Azure Audit Log data ingested via the Elastic Azure integration. Covers service principal credential additions, certificate and secret management, application ownership changes, app role assignments, and app password creation (which can be used to bypass MFA). Fields are extracted from the azure.auditlogs ECS-mapped namespace and enriched with risk classifications for triage.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate CI/CD pipelines (Terraform, GitHub Actions, Azure DevOps) that automatically create or rotate service principal credentials as part of infrastructure provisioning workflows
- IT administrators performing scheduled credential rotation or certificate lifecycle management via the Azure portal or scripted tooling
- Azure Managed Identity automation and service provisioning that registers new applications or assigns credentials during infrastructure deployments
Other platforms for T1098.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Client Secret to Entra ID Application via Azure CLI
Expected signal: Entra ID Audit Logs: OperationName='Update application – Certificates and secrets management' or 'Add service principal credentials' with Result=success. InitiatedBy will show the authenticated CLI user. TargetResources will contain the application object ID and display name. ModifiedProperties will include the new credential's KeyId, StartDate, EndDate, and CustomKeyIdentifier.
- Test 2Create AWS IAM Access Key for Existing User via AWS CLI
Expected signal: AWS CloudTrail: EventName='CreateAccessKey' with requestParameters.userName=<TARGET_USERNAME>, responseElements.accessKey.accessKeyId=<NEW_KEY_ID>, responseElements.accessKey.status='Active'. UserIdentity section shows the requesting account. EventSource=iam.amazonaws.com.
- Test 3Add Certificate Credential to Entra ID Service Principal via PowerShell
Expected signal: Entra ID Audit Logs: OperationName='Add service principal credentials' with Result=success. ModifiedProperties will contain KeyCredentials with Type=AsymmetricX509Cert, Usage=Verify, and the certificate's StartDate/EndDate. PowerShell ScriptBlock Logging (Event ID 4104) will capture the New-AzADSpCredential command. Sysmon Event ID 1 will show powershell.exe execution.
- Test 4Create Entra ID App Password for MFA Bypass via Microsoft Graph API
Expected signal: Entra ID Audit Logs: OperationName='Create application password for user' with Result=success. InitiatedBy will show the authenticated Graph API caller. TargetResources will contain the target user's UPN and object ID. Microsoft Defender for Cloud Apps may also generate an alert for unusual MFA modification activity.
References (18)
- https://attack.mitre.org/techniques/T1098/001/
- https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
- https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/
- https://expel.io/blog/finding-evil-in-aws/
- https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
- https://sysdig.com/blog/scarleteel-2-0/
- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud
- https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/
- https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add
- https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations
- https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords
- https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts
- https://github.com/RhinoSecurityLabs/pacu
- https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities
- https://learn.microsoft.com/en-us/graph/api/resources/auditlog-root
- https://docs.microsoft.com/en-us/powershell/module/az.resources/new-azadspredential
Unlock Pro Content
Get the full detection package for T1098.001 including response playbook, investigation guide, and atomic red team tests.