Elastic medium stable eql

Azure Service Principal Sign-In Followed by Arc Cluster Credential Access

Detects when a service principal authenticates to Microsoft Entra ID and then lists credentials for an Azure Arc-connected Kubernetes cluster within a short time window. The `listClusterUserCredential` action retrieves tokens that enable kubectl access through the Arc Cluster Connect proxy. This sequence (service principal sign-in followed by Arc credential retrieval), represents the exact attack chain used by adversaries with stolen service principal secrets to establish a proxy tunnel into Kubernetes clusters. Service principals that authenticate externally (as opposed to managed identities) and immediately access Arc cluster credentials warrant investigation, particularly when the sign-in originates from an unexpected location or ASN.

View Source

Detection Logic

sequence with maxspan=30m
[authentication where data_stream.dataset == "azure.signinlogs"
    and azure.signinlogs.category == "ServicePrincipalSignInLogs"
    and azure.signinlogs.properties.status.error_code == 0
] by azure.signinlogs.properties.app_id
[any where data_stream.dataset == "azure.activitylogs"
    and azure.activitylogs.operation_name : "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/LISTCLUSTERUSERCREDENTIAL/ACTION"
    and event.outcome : ("Success", "success")
] by azure.activitylogs.identity.claims.appid

False Positives

⚠ CI/CD pipelines that authenticate as a service principal and then access Arc clusters as part of deployment workflows will trigger this rule. Identify and exclude known automation service principal app IDs.
⚠ Administrators using service principal credentials to manage Arc-connected clusters during maintenance windows may trigger this rule. Correlate with change management records.

Field Validations

Loading…

Comments (0)

Loading comments...