Multiple Azure AD Service Principals Created by Single User

This threat brief focuses on the rapid creation of Azure AD service principals by a single user. The behavior is flagged when a user creates more than three unique OAuth applications within a 10-minute window, using the "Add service principal" operation. This activity is suspicious because it deviates from typical administrative tasks and could signal an attacker attempting to establish persistence or expand their access within the Azure environment. This activity has been associated with threat actors such as NOBELIUM. Defenders should monitor Azure AD audit logs for anomalous service principal creation patterns.

Attack Chain

1. An attacker gains initial access to an Azure AD user account, possibly through credential compromise or phishing.
2. The attacker logs into the Azure portal or uses Azure CLI with the compromised account.
3. The attacker programmatically or manually initiates the creation of multiple new service principals using the "Add service principal" operation.
4. Each service principal is configured with OAuth application permissions.
5. The attacker configures the service principals to grant them elevated privileges within the Azure environment.
6. The attacker uses the newly created service principals to access sensitive data or resources.
7. The attacker establishes persistence by using the service principals to maintain access even if the original compromised account is remediated.

Impact

Successful exploitation allows attackers to establish persistence, escalate privileges, and gain unauthorized access to sensitive resources within the Azure Active Directory environment. This can lead to data breaches, service disruptions, and further compromise of the organization's cloud infrastructure. The creation of rogue service principals can be difficult to detect and remediate without proper monitoring and alerting.

Recommendation

• Deploy the Azure AD Multiple Service Principals Created by User detection rule to your SIEM to identify suspicious service principal creation activity in Azure AD logs.
• Investigate any alerts generated by the detection rule and determine the legitimacy of the service principal creation activity.
• Implement multi-factor authentication (MFA) for all user accounts to reduce the risk of credential compromise (reference: https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/).
• Review and audit existing service principals and their associated permissions to identify and remove any rogue or unnecessary service principals.