Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

SenservaPro AD Applications Not Using Client Credentials

Back
Id56910d7b-aae7-452c-a3ed-89f72ef59234
RulenameSenservaPro AD Applications Not Using Client Credentials
DescriptionSearches for logs of AD Applications without Client Credentials (Key or Secret)
SeverityMedium
TacticsImpact
TechniquesT1529
T1485
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AppsNoClientCredentials.yaml
Version1.0.0
Arm template56910d7b-aae7-452c-a3ed-89f72ef59234.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'ApplicationNotUsingClientCredentials'
version: 1.0.0
relevantTechniques:
- T1529
- T1485
description: |
    'Searches for logs of AD Applications without Client Credentials (Key or Secret)'
requiredDataConnectors:
- connectorId: SenservaPro
  dataTypes:
  - SenservaPro_CL
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: ControlName_s
  - identifier: AadTenantId
    columnName: TenantId
  - identifier: DisplayName
    columnName: TenantDisplayName_s
  entityType: Account
- fieldMappings:
  - identifier: DistinguishedName
    columnName: Group_s
  entityType: SecurityGroup
- fieldMappings:
  - identifier: ResourceId
    columnName: SourceSystem
  entityType: AzureResource
triggerThreshold: 0
id: 56910d7b-aae7-452c-a3ed-89f72ef59234
tactics:
- Impact
queryPeriod: 6h
query: |
  SenservaPro_CL
  | where ControlName_s == 'ApplicationNotUsingClientCredentials'  
severity: Medium
name: SenservaPro AD Applications Not Using Client Credentials
kind: Scheduled
queryFrequency: 6h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AppsNoClientCredentials.yaml
triggerOperator: gt
status: Available
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/56910d7b-aae7-452c-a3ed-89f72ef59234')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/56910d7b-aae7-452c-a3ed-89f72ef59234')]",
      "properties": {
        "alertRuleTemplateName": "56910d7b-aae7-452c-a3ed-89f72ef59234",
        "customDetails": null,
        "description": "'Searches for logs of AD Applications without Client Credentials (Key or Secret)'\n",
        "displayName": "SenservaPro AD Applications Not Using Client Credentials",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ControlName_s",
                "identifier": "Name"
              },
              {
                "columnName": "TenantId",
                "identifier": "AadTenantId"
              },
              {
                "columnName": "TenantDisplayName_s",
                "identifier": "DisplayName"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "Group_s",
                "identifier": "DistinguishedName"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "ResourceId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AppsNoClientCredentials.yaml",
        "query": "SenservaPro_CL\n| where ControlName_s == 'ApplicationNotUsingClientCredentials'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485",
          "T1529"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}