Detection of Unauthorized Azure Application Credential Modifications

Monitoring the modification of Microsoft Entra (formerly Azure AD) application credentials is a critical defensive requirement. Threat actors often target service principals and applications to establish long-term persistence or escalate privileges by adding their own certificates or client secrets. By modifying existing applications, attackers can gain unauthorized access to protected resources, bypass conditional access policies, and maintain access even if user-level credentials are rotated. This intelligence highlights the need to baseline and alert on credential changes that occur outside of established DevOps workflows, infrastructure-as-code deployments, or authorized administrative actions.

Impact

Successful modification of application credentials allows attackers to impersonate service principals, potentially resulting in unauthorized data exfiltration, service disruption, or further lateral movement within the cloud environment. Organizations failing to monitor these changes may remain unaware of persistent unauthorized access for extended periods.

Recommendation

Deploy the following Sigma detection rule to Azure audit logs to identify credential updates. Tune the rule by correlating alerts against authorized deployment service principals or known maintenance windows to reduce false positives.

• Enable Azure Monitor or Log Analytics ingestion for Entra Audit Logs.
• Configure alerts based on the detection rule below to trigger for non-standard administrative accounts.
• Review existing application owners and credential lifecycle management practices.