Azure AD Multiple Service Principals Created by Single Principal

This analytic detects anomalous behavior in Azure Active Directory (Azure AD) where a single service principal creates more than three unique OAuth applications within a 10-minute span. The activity is identified by monitoring the "Add service principal" operation in Azure AD audit logs. This behavior is significant because it might indicate a compromised or malicious service principal being used to rapidly establish multiple service principals. This rapid creation of service principals could be used to stage a larger attack, enabling unauthorized access, persistence within the environment, and potential lateral movement across the cloud infrastructure. This technique has been associated with advanced persistent threat groups like NOBELIUM, known for targeting cloud environments.

Attack Chain

1. An attacker compromises an existing Azure AD service principal, potentially through credential theft or application compromise.
2. The attacker authenticates to Azure AD using the compromised service principal's credentials.
3. The attacker leverages the compromised service principal to execute the "Add service principal" operation in Azure AD.
4. The attacker rapidly creates multiple new service principals (more than 3) within a short timeframe (10 minutes). Each new service principal is essentially a new application registration and service principal object.
5. The attacker grants the newly created service principals elevated privileges or permissions within the Azure AD environment.
6. The attacker uses the newly created service principals to access resources or perform actions that the compromised service principal did not have permission to access, thus achieving lateral movement.
7. The attacker leverages the new service principals for persistence, ensuring continued access even if the initial compromised service principal is detected or revoked.
8. The attacker may use the newly created service principals to exfiltrate data or deploy malicious applications.

Impact

A successful attack can lead to unauthorized access to sensitive resources within the Azure AD environment, enabling data exfiltration, lateral movement to other cloud services, and long-term persistence. Multiple OAuth applications were created by a compromised service principal in a short period of time. This can lead to full compromise of the Azure AD tenant. The impact is high, given the potential for widespread data breach and disruption of cloud services.

Recommendation

• Deploy the Sigma rule Azure AD Multiple Service Principals Created by SP to your SIEM and tune for your environment to detect this specific behavior.
• Investigate any alerts generated by the Sigma rule, focusing on the src_user field to identify the potentially compromised service principal.
• Review the permissions and activities of the identified service principal to determine the extent of the compromise.
• Follow Microsoft's guidance for responders on nation-state attacks, as referenced in the brief, to remediate the compromise and prevent further damage.
• Monitor Azure AD audit logs for suspicious "Add service principal" operations, specifically those initiated by service principals.
• Implement multi-factor authentication (MFA) for all service principals to mitigate the risk of credential theft.