Sigma high test sigma

Added Credentials to Existing Application

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

View Source

Detection Logic

{
  "selection": {
    "properties.message": [
      "Update application - Certificates and secrets management",
      "Update Service principal/Update Application"
    ]
  },
  "condition": "selection"
}

False Positives

⚠ When credentials are added/removed as part of the normal working hours/workflows

Field Validations

Loading…

Comments (0)

Loading comments...