Microsoft 365 app credential added
A credential (client secret or certificate) was added to a Microsoft Entra application or service principal ("Add service principal credentials."…
What it detects
A credential (client secret or certificate) was added to a Microsoft Entra application or service principal ("Add service principal credentials.", "Update application – Certificates and secrets management."). A new app credential grants standing, password-less, MFA-bypassing access to whatever the app can reach — a common cloud-persistence backdoor after an admin or application-owner compromise, and the usual follow-on to an illicit OAuth consent.
MITRE ATT&CK mapping
- T1098.001Account Manipulation: Additional Cloud Credentials· Persistence
False positives and triage
Developers and CI/CD legitimately rotate app secrets and certificates. Confirm the application, the actor, and whether the change was expected — a new credential on a high-privilege app (Mail.*, Directory.*, full_access_as_app) added by an unexpected actor is the concern.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_app_credential_added.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_app_credential_added
version: 1.1.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1098.001]
description: |
A credential (client secret or certificate) was added to a Microsoft Entra
application or service principal ("Add service principal credentials.", "Update
application – Certificates and secrets management."). A new app credential grants
standing, password-less, MFA-bypassing access to whatever the app can reach — a
common cloud-persistence backdoor after an admin or application-owner compromise,
and the usual follow-on to an illicit OAuth consent.
match:
provider_any: [Office365, AzureAD]
event_action_contains_any:
- "Add service principal credentials"
- "Certificates and secrets management"
- "Add federated identity credential"
raw_message_contains_any:
- "KeyIdentifier"
- "KeyType"
- "KeyUsage"
- "KeyCredential"
- "PasswordCredential"
correlation_keys: [user_name]
false_positive_guidance: |
Developers and CI/CD legitimately rotate app secrets and certificates. Confirm the
application, the actor, and whether the change was expected — a new credential on a
high-privilege app (Mail.*, Directory.*, full_access_as_app) added by an unexpected
actor is the concern.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.