Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

SenservaPro AD Applications Not Using Client Credentials

Back
Id56910d7b-aae7-452c-a3ed-89f72ef59234
RulenameSenservaPro AD Applications Not Using Client Credentials
DescriptionSearches for logs of AD Applications without Client Credentials (Key or Secret)
SeverityMedium
TacticsImpact
TechniquesT1529
T1485
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AppsNoClientCredentials.yaml
Version1.0.0
Arm template56910d7b-aae7-452c-a3ed-89f72ef59234.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'ApplicationNotUsingClientCredentials'
name: SenservaPro AD Applications Not Using Client Credentials
triggerOperator: gt
status: Available
relevantTechniques:
- T1529
- T1485
query: |
  SenservaPro_CL
  | where ControlName_s == 'ApplicationNotUsingClientCredentials'  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AppsNoClientCredentials.yaml
description: |
    'Searches for logs of AD Applications without Client Credentials (Key or Secret)'
triggerThreshold: 0
id: 56910d7b-aae7-452c-a3ed-89f72ef59234
kind: Scheduled
severity: Medium
version: 1.0.0
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: ControlName_s
  - identifier: AadTenantId
    columnName: TenantId
  - identifier: DisplayName
    columnName: TenantDisplayName_s
  entityType: Account
- fieldMappings:
  - identifier: DistinguishedName
    columnName: Group_s
  entityType: SecurityGroup
- fieldMappings:
  - identifier: ResourceId
    columnName: SourceSystem
  entityType: AzureResource
queryFrequency: 6h
queryPeriod: 6h
requiredDataConnectors:
- dataTypes:
  - SenservaPro_CL
  connectorId: SenservaPro
tactics:
- Impact
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/56910d7b-aae7-452c-a3ed-89f72ef59234')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/56910d7b-aae7-452c-a3ed-89f72ef59234')]",
      "properties": {
        "alertRuleTemplateName": "56910d7b-aae7-452c-a3ed-89f72ef59234",
        "customDetails": null,
        "description": "'Searches for logs of AD Applications without Client Credentials (Key or Secret)'\n",
        "displayName": "SenservaPro AD Applications Not Using Client Credentials",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ControlName_s",
                "identifier": "Name"
              },
              {
                "columnName": "TenantId",
                "identifier": "AadTenantId"
              },
              {
                "columnName": "TenantDisplayName_s",
                "identifier": "DisplayName"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "Group_s",
                "identifier": "DistinguishedName"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "ResourceId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AppsNoClientCredentials.yaml",
        "query": "SenservaPro_CL\n| where ControlName_s == 'ApplicationNotUsingClientCredentials'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485",
          "T1529"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}