Anvilogic high experimental spl
Add secret to Azure service principal [splunk-add]
The attacker ( logged in as a low privileged user) could add a new secret to the service principal, then login to Azure PowerShell as that service principal. - Threat Actor Association: APT29/Nobelium/Cozy Bear, Storm-1283
Detection Logic
`get_cloud_data` "New-AzADAppCredential" TERM(success)
| table _time, host, user,account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id
| bin span=1s
| stats values(*) as * by _time, userField Validations
Loading…
Comments (0)
Loading comments...