Detect Additional Cloud Credentials in Sumo Logic CSE
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. This includes adding credentials to Azure/Entra ID Service Principals and Applications (x509 keys and passwords), generating or importing SSH keys in AWS/GCP, creating AWS IAM access keys or login profiles, and adding app passwords to Entra ID user accounts to bypass MFA. These techniques allow persistent access even if the original compromised credentials are rotated.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1098 Account Manipulation
- Sub-technique
- T1098.001 Additional Cloud Credentials
- Canonical reference
- https://attack.mitre.org/techniques/T1098/001/
Sumo Detection Query
_sourceCategory="Azure/AuditLogs" OR _sourceCategory="azure/aad/audit" OR _sourceCategory="Azure/ActiveDirectory/Audit"
| json "operationName" as OperationName nodrop
| json "properties.result" as Result nodrop
| json "properties.initiatedBy.user.userPrincipalName" as InitiatingUPN nodrop
| json "properties.initiatedBy.user.ipAddress" as InitiatingIPAddress nodrop
| json "properties.initiatedBy.app.displayName" as InitiatingApp nodrop
| json "properties.targetResources[0].displayName" as TargetResource nodrop
| json "properties.targetResources[0].type" as TargetType nodrop
| json "properties.correlationId" as CorrelationId nodrop
| where OperationName in (
"Add service principal credentials",
"Update application \u2013 Certificates and secrets management",
"Add application",
"Update service principal",
"Add owner to application",
"Add app role assignment to service principal",
"Create application password for user",
"Update application password for user",
"Delete application password for user"
)
| where Result = "success" or isNull(Result) or Result = ""
| if (OperationName matches "(?i)certificate|secret", "Certificate_or_Secret",
if (OperationName matches "(?i)password", "AppPassword",
if (OperationName matches "(?i)credentials", "ServicePrincipalCredential", "Other"))) as CredentialType
| if (OperationName = "Create application password for user", "MFA_Bypass_Risk",
if (OperationName = "Add service principal credentials", "SP_Credential_Add",
if (OperationName = "Add owner to application", "Ownership_Change", "Low"))) as IsHighRisk
| if (matches(InitiatingUPN, "(?i)(svc[-_]|service|automation|pipeline|deploy|robot|bot)"), "Yes", "No") as IsServiceAccount
| if (InitiatingUPN = TargetResource, "Yes", "No") as IsSelfModification
| fields _messageTime, OperationName, Result, InitiatingUPN, InitiatingApp, InitiatingIPAddress, TargetResource, TargetType, CredentialType, IsHighRisk, IsServiceAccount, IsSelfModification, CorrelationId
| sort by _messageTime descDetects Azure/Entra ID service principal and application credential additions using Azure Audit Log data collected into Sumo Logic via the Azure Monitor diagnostic settings pipeline or the Sumo Logic Azure collection. Parses nested JSON fields from the raw audit log payload to extract the initiating identity, target resource, and operation type. Applies inline enrichment for credential type classification, high-risk flagging, and service account identification. Adjust _sourceCategory values to match your environment's collection configuration.
Data Sources
Required Tables
False Positives & Tuning
- Automated DevOps pipelines that programmatically create or rotate Azure AD service principal credentials during application deployments or environment bootstrapping
- IT helpdesk staff adding app passwords to user accounts at the user's request for legacy applications that do not support modern authentication
- Security tooling or CASB products that register Azure AD applications with certificates as part of their tenant onboarding or token acquisition workflows
Other platforms for T1098.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Client Secret to Entra ID Application via Azure CLI
Expected signal: Entra ID Audit Logs: OperationName='Update application – Certificates and secrets management' or 'Add service principal credentials' with Result=success. InitiatedBy will show the authenticated CLI user. TargetResources will contain the application object ID and display name. ModifiedProperties will include the new credential's KeyId, StartDate, EndDate, and CustomKeyIdentifier.
- Test 2Create AWS IAM Access Key for Existing User via AWS CLI
Expected signal: AWS CloudTrail: EventName='CreateAccessKey' with requestParameters.userName=<TARGET_USERNAME>, responseElements.accessKey.accessKeyId=<NEW_KEY_ID>, responseElements.accessKey.status='Active'. UserIdentity section shows the requesting account. EventSource=iam.amazonaws.com.
- Test 3Add Certificate Credential to Entra ID Service Principal via PowerShell
Expected signal: Entra ID Audit Logs: OperationName='Add service principal credentials' with Result=success. ModifiedProperties will contain KeyCredentials with Type=AsymmetricX509Cert, Usage=Verify, and the certificate's StartDate/EndDate. PowerShell ScriptBlock Logging (Event ID 4104) will capture the New-AzADSpCredential command. Sysmon Event ID 1 will show powershell.exe execution.
- Test 4Create Entra ID App Password for MFA Bypass via Microsoft Graph API
Expected signal: Entra ID Audit Logs: OperationName='Create application password for user' with Result=success. InitiatedBy will show the authenticated Graph API caller. TargetResources will contain the target user's UPN and object ID. Microsoft Defender for Cloud Apps may also generate an alert for unusual MFA modification activity.
References (18)
- https://attack.mitre.org/techniques/T1098/001/
- https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
- https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/
- https://expel.io/blog/finding-evil-in-aws/
- https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
- https://sysdig.com/blog/scarleteel-2-0/
- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud
- https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/
- https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add
- https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations
- https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords
- https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts
- https://github.com/RhinoSecurityLabs/pacu
- https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities
- https://learn.microsoft.com/en-us/graph/api/resources/auditlog-root
- https://docs.microsoft.com/en-us/powershell/module/az.resources/new-azadspredential
Unlock Pro Content
Get the full detection package for T1098.001 including response playbook, investigation guide, and atomic red team tests.