Service_principal - CraftedSignal Threat Feed

Entra ID Service Principal Creation for Persistence

hello@craftedsignal.io — Tue, 30 Jan 2024 12:00:00 +0000

This rule detects the creation of new service principals within Microsoft Entra ID. Service principals are identities used by applications, services, and automation tools to access specific resources within Azure. While legitimate use of service principals is common for automation and application access, adversaries can create them to establish persistence mechanisms or to masquerade as legitimate services or applications. This activity is often performed to maintain unauthorized access to cloud resources and evade detection by blending in with normal automated processes. Identifying anomalous service principal creation can help prevent malicious actors from maintaining a foothold within an Azure environment. The rule focuses on detecting the "Add service principal" operation within the Azure Audit Logs.

Attack Chain

An attacker gains initial access to an Azure environment through compromised credentials or a vulnerability.
The attacker authenticates to the Azure portal or uses the Azure CLI/PowerShell with the compromised account.
The attacker executes commands to create a new service principal within the Entra ID tenant. This involves assigning a name, application ID, and defining the roles and permissions for the service principal.
The service principal is configured with specific roles, granting it access to various Azure resources.
The attacker uses the newly created service principal to authenticate and access Azure resources.
The attacker leverages the service principal's permissions to perform malicious activities, such as data exfiltration, resource modification, or lateral movement.
The attacker uses the service principal for long-term persistence, maintaining access even if the initial access vector is remediated.

Impact

Successful exploitation allows attackers to maintain persistent access to Azure resources. Depending on the assigned roles and permissions, the attacker can perform a wide range of malicious activities, including data exfiltration, resource manipulation, and further compromise of the environment. The impact is limited to the permissions granted to the created service principal but can be significant if the service principal is assigned highly privileged roles. Since this is an Entra ID event, all organizations utilizing Azure services are potentially in scope.

Recommendation

Deploy the Sigma rule "Entra ID Service Principal Created" to your SIEM and tune for your environment, focusing on excluding known good service principal creation activities (e.g., from automated deployment pipelines).
Review and audit existing service principals and their assigned roles regularly to identify any suspicious or unauthorized principals.
Monitor Azure Audit Logs for unusual or unauthorized "Add service principal" operations, paying close attention to the identity creating the service principal.
Follow Microsoft's security best practices for identity management in Azure (https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices).

Entra ID Service Principal Sign-in from Unusual Source ASN

hello@craftedsignal.io — Wed, 03 Jan 2024 14:30:00 +0000

This detection identifies potentially malicious activity within Microsoft Entra ID (formerly Azure AD) by monitoring service principal sign-ins. Specifically, it flags instances where a service principal authenticates from an autonomous system number (ASN) that is not typically associated with that principal within a defined history window (10 days). Attackers compromising service principal credentials or application secrets may attempt to authenticate from unfamiliar networks, such as hosting providers, VPNs, or residential IPs, to gain initial access, move laterally, or deploy ransomware within the tenant. The rule focuses on identifying new network paths for non-interactive workload identities, improving the chances of catching malicious activity early in the attack chain. This detection is based on the Elastic detection rule released on 2026/04/06.

Attack Chain

The attacker gains unauthorized access to service principal credentials or application secrets.
The attacker uses the compromised credentials to attempt authentication to Entra ID.
The authentication request originates from an unusual ASN not previously associated with the service principal.
Entra ID processes the authentication request and, if successful based on existing policies, grants access.
The service principal, now under attacker control, performs actions based on its assigned permissions. This could include accessing sensitive data, modifying configurations, or escalating privileges.
The attacker leverages the compromised service principal to move laterally within the cloud environment, accessing other resources or identities.
The attacker may exfiltrate sensitive data or deploy malicious applications or scripts.
The attacker may deploy ransomware targeting cloud resources.

Impact

A successful attack leveraging compromised service principal credentials can result in significant damage, including data breaches, service disruptions, and financial losses. The potential impact extends to any resources accessible by the compromised service principal, potentially affecting critical business applications and data. If undetected, this activity can lead to full tenant compromise and significant remediation costs. Lateral movement and privilege escalation can further amplify the impact, affecting more resources and data within the environment.

Recommendation

Deploy the Sigma rule Entra ID Service Principal Sign-in from Unusual ASN to your SIEM, ensuring it is tuned to exclude known benign ASNs for your service principals.
Review sign-in logs for successful authentications by service principals originating from unfamiliar ASNs as per the investigation guide provided in the rule description.
Implement conditional access policies to restrict service principal sign-ins to specific networks or locations.
Rotate application secrets and certificates for any service principal triggering the Entra ID Service Principal Sign-in from Unusual ASN detection.
Monitor Entra ID audit logs for changes to application permissions, client secrets, or ownership, especially before a suspicious sign-in, as described in the rule's triage steps.
Enrich source.ip addresses from alerts with threat intelligence data to identify residential or low-reputation ASNs, warranting increased scrutiny.

O365 Service Principal Creation Detection

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on the detection of newly created service principal accounts within Microsoft Office 365 environments. The creation of service principals is a legitimate administrative function, but malicious actors can exploit them to gain persistent access to cloud resources. Attackers, like the NOBELIUM group, can use compromised or maliciously created service principals to interact with APIs, access sensitive data, and perform unauthorized operations on behalf of the organization. These actions can lead to significant data breaches, lateral movement, and further compromise of the O365 tenant. This activity is often associated with advanced persistent threat (APT) groups targeting cloud environments for long-term access and data exfiltration. The detection strategy leverages O365 management activity logs to identify suspicious creation events, allowing for proactive investigation and mitigation of potential threats.

Attack Chain

Initial Access: Attacker gains initial access to an O365 account, possibly through phishing or credential stuffing (not directly observed in the provided data, but a common precursor).
Privilege Escalation: The attacker escalates privileges within the compromised account to allow for the creation of service principals.
Service Principal Creation: A new service principal is created within the Azure Active Directory, using commands or API calls. The creation event is logged within the O365 management activity logs.
Permissions Assignment: The attacker assigns the newly created service principal with elevated permissions, granting access to critical resources within the O365 environment.
API Access: The attacker leverages the service principal to interact with Microsoft Graph API or other O365 APIs, bypassing standard user authentication mechanisms.
Data Exfiltration: The attacker utilizes the API access to exfiltrate sensitive data from various O365 services, such as SharePoint, OneDrive, or Exchange Online.
Persistence: The service principal acts as a persistent backdoor, allowing the attacker to regain access to the environment even if the initial compromised account is remediated.

Impact

A successful attack involving a rogue service principal can lead to significant data breaches, with potential exposure of sensitive corporate data, customer information, and intellectual property. The number of victims depends on the permissions assigned to the malicious service principal and the scope of data accessible within the O365 environment. Affected sectors include any organization relying on O365 for business operations, but especially those with sensitive data like finance, healthcare, and government. If the attack succeeds, organizations face reputational damage, financial losses, legal liabilities, and operational disruption.

Recommendation

Deploy the provided Sigma rules to your SIEM and tune them to reduce false positives based on your organization's normal service principal creation activity (rules).
Investigate any alerts generated by the Sigma rules, focusing on the user accounts responsible for creating the service principals and the permissions assigned to them (rules).
Enable and review O365 Management Activity logs to ensure comprehensive monitoring of service principal creation and modification events (data_source).
Implement multi-factor authentication (MFA) for all user accounts, including administrative accounts, to mitigate the risk of initial access through compromised credentials (T1136.003).
Review and enforce the principle of least privilege for service principals, limiting their access to only the resources they require (T1136.003).
Monitor for anomalous API usage patterns associated with service principals, such as unusual data access or exfiltration activities (T1136.003).

Entra ID Service Principal Credentials Created by Unusual User

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies when new Service Principal credentials (client secrets or certificates) are added in Microsoft Entra ID by a user who has not previously performed this action in the last 10 days. Attackers who gain access to a user account may add rogue credentials to service principals to maintain unauthorized access to cloud resources, bypassing MFA requirements. This activity may indicate an attacker attempting to establish persistence or escalate privileges within the Azure environment. The rule leverages the azure.auditlogs dataset to identify unusual activity related to service principal credential management. This is a New Terms rule that detects rare users performing sensitive identity-related actions in Entra ID.

Attack Chain

Attacker gains initial access to a user account through compromised credentials or other means (T1078).
Attacker identifies a target service principal with valuable permissions within the Azure environment.
Attacker navigates to the Entra ID portal or uses Azure CLI/PowerShell to manage the target service principal.
Attacker adds a new credential (client secret or certificate) to the service principal using Add service principal credentials operation.
The operation is logged in the Azure Audit Logs with event outcome as success and operation name containing the event.
Attacker uses the newly added credential to authenticate as the service principal and access protected resources (T1098.001).
Attacker leverages the service principal's permissions to perform unauthorized actions, such as data exfiltration or resource modification.
The attacker maintains persistent access to the environment through the rogue service principal credential.

Impact

A successful attack can lead to unauthorized access to sensitive data and resources within the Azure environment. The impact includes potential data breaches, financial loss, and reputational damage. By compromising a service principal, attackers can bypass multi-factor authentication (MFA) and other security controls, leading to privilege escalation and lateral movement. If successful, the attacker could access data normally protected by MFA requirements.

Recommendation

Deploy the Sigma rule "Entra ID Service Principal Credentials Created by Unusual User" to your SIEM and tune for your environment.
Investigate any alerts generated by the Sigma rule by reviewing the user account, source IP, and credential type.
Review RBAC and Least Privilege: Ensure that only authorized identities have permission to add credentials to service principals (T1098.001).
Enable logging for Azure Audit Logs to provide the data source for the Sigma rules.
Consider implementing access control policies that require approvals for modifying service principals or adding credentials.