Detect Additional Cloud Credentials in CrowdStrike LogScale
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. This includes adding credentials to Azure/Entra ID Service Principals and Applications (x509 keys and passwords), generating or importing SSH keys in AWS/GCP, creating AWS IAM access keys or login profiles, and adding app passwords to Entra ID user accounts to bypass MFA. These techniques allow persistent access even if the original compromised credentials are rotated.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1098 Account Manipulation
- Sub-technique
- T1098.001 Additional Cloud Credentials
- Canonical reference
- https://attack.mitre.org/techniques/T1098/001/
LogScale Detection Query
// T1098.001 - Additional Cloud Credentials - Azure/Entra ID
// Requires Azure Active Directory audit logs ingested into LogScale
// Adjust #vendor and #product tags to match your ingestion configuration
#vendor="Microsoft" #product="AzureActiveDirectory" #type="AuditLog"
| OperationName in values=[
"Add service principal credentials",
"Update application \u2013 Certificates and secrets management",
"Add application",
"Update service principal",
"Add owner to application",
"Add app role assignment to service principal",
"Create application password for user",
"Update application password for user",
"Delete application password for user"
]
| in(field=Result, values=["success", ""])
| InitiatingUPN := properties.initiatedBy.user.userPrincipalName
| InitiatingIPAddress := properties.initiatedBy.user.ipAddress
| InitiatingApp := properties.initiatedBy.app.displayName
| TargetResource := properties.targetResources[0].displayName
| TargetType := properties.targetResources[0].type
| CorrelationId := properties.correlationId
| CredentialType := case {
OperationName = /(?i)certificate|secret/ => "Certificate_or_Secret" ;
OperationName = /(?i)password/ => "AppPassword" ;
OperationName = /(?i)credentials/ => "ServicePrincipalCredential" ;
* => "Other"
}
| IsHighRisk := case {
OperationName = "Create application password for user" => "MFA_Bypass_Risk" ;
OperationName = "Add service principal credentials" => "SP_Credential_Add" ;
OperationName = "Add owner to application" => "Ownership_Change" ;
* => "Low"
}
| IsServiceAccount := case {
InitiatingUPN = /(?i)(svc[-_]|service|automation|pipeline|deploy|robot|bot)/ => "Yes" ;
* => "No"
}
| IsSelfModification := if(InitiatingUPN = TargetResource, "Yes", "No")
| table([@timestamp, OperationName, Result, InitiatingUPN, InitiatingApp, InitiatingIPAddress, TargetResource, TargetType, CredentialType, IsHighRisk, IsServiceAccount, IsSelfModification, CorrelationId])
| sort(field=@timestamp, order=desc, limit=1000)CrowdStrike LogScale (Humio) query detecting Azure/Entra ID service principal and application credential additions. Requires Azure Active Directory audit logs to be ingested into LogScale, either via the CrowdStrike Falcon CSPM Azure integration, a custom log shipper, or the Azure Monitor diagnostic export pipeline. Field extraction uses dot-notation against the raw JSON payload. The query applies inline conditional enrichment for credential type, risk classification, service account detection, and self-modification flagging. Adjust the #vendor and #product repository tags to match your LogScale ingestion labeling scheme.
Data Sources
Required Tables
False Positives & Tuning
- Automated credential rotation pipelines for service principals used by CI/CD systems (Azure DevOps, GitHub Actions) that reset credentials on a defined schedule and generate audit events under service account UPNs
- Platform engineering workflows that use Terraform or Pulumi to manage Azure AD applications, where plan-apply cycles create or update application credentials during infrastructure changes
- Enterprise application gallery integrations where Microsoft or third-party vendors automatically configure service principal credentials during initial SSO provisioning in the tenant
Other platforms for T1098.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Client Secret to Entra ID Application via Azure CLI
Expected signal: Entra ID Audit Logs: OperationName='Update application – Certificates and secrets management' or 'Add service principal credentials' with Result=success. InitiatedBy will show the authenticated CLI user. TargetResources will contain the application object ID and display name. ModifiedProperties will include the new credential's KeyId, StartDate, EndDate, and CustomKeyIdentifier.
- Test 2Create AWS IAM Access Key for Existing User via AWS CLI
Expected signal: AWS CloudTrail: EventName='CreateAccessKey' with requestParameters.userName=<TARGET_USERNAME>, responseElements.accessKey.accessKeyId=<NEW_KEY_ID>, responseElements.accessKey.status='Active'. UserIdentity section shows the requesting account. EventSource=iam.amazonaws.com.
- Test 3Add Certificate Credential to Entra ID Service Principal via PowerShell
Expected signal: Entra ID Audit Logs: OperationName='Add service principal credentials' with Result=success. ModifiedProperties will contain KeyCredentials with Type=AsymmetricX509Cert, Usage=Verify, and the certificate's StartDate/EndDate. PowerShell ScriptBlock Logging (Event ID 4104) will capture the New-AzADSpCredential command. Sysmon Event ID 1 will show powershell.exe execution.
- Test 4Create Entra ID App Password for MFA Bypass via Microsoft Graph API
Expected signal: Entra ID Audit Logs: OperationName='Create application password for user' with Result=success. InitiatedBy will show the authenticated Graph API caller. TargetResources will contain the target user's UPN and object ID. Microsoft Defender for Cloud Apps may also generate an alert for unusual MFA modification activity.
References (18)
- https://attack.mitre.org/techniques/T1098/001/
- https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
- https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/
- https://expel.io/blog/finding-evil-in-aws/
- https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
- https://sysdig.com/blog/scarleteel-2-0/
- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud
- https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/
- https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add
- https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations
- https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords
- https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts
- https://github.com/RhinoSecurityLabs/pacu
- https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities
- https://learn.microsoft.com/en-us/graph/api/resources/auditlog-root
- https://docs.microsoft.com/en-us/powershell/module/az.resources/new-azadspredential
Unlock Pro Content
Get the full detection package for T1098.001 including response playbook, investigation guide, and atomic red team tests.