Service principal not using client credentials

Back


Id	D308318A-B298-4E57-82BD-74AE33C4A539
Rulename	Service principal not using client credentials
Description	This query searches for an service principal is not using a client certificate or secret is not secure. It is recommended that you review your needs and use an Authentication method for sign-in.
Severity	High
Tactics	InitialAccess
Techniques	T1078
Required data connectors	SenservaPro
Kind	Scheduled
Query frequency	6h
Query period	6h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/NotUsingClientCredentials.yaml
Version	1.0.1
Arm template	D308318A-B298-4E57-82BD-74AE33C4A539.json

KQL

SenservaPro_CL
| where ControlName_s == 'ServicePrincipalNotUsingClientCredentials'

YAML

queryPeriod: 6h
query: |
  SenservaPro_CL
  | where ControlName_s == 'ServicePrincipalNotUsingClientCredentials'  
name: Service principal not using client credentials
entityMappings:
- fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
  entityType: Account
- fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
  entityType: SecurityGroup
- fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
  entityType: AzureResource
queryFrequency: 6h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/NotUsingClientCredentials.yaml
requiredDataConnectors:
- connectorId: SenservaPro
  dataTypes:
  - SenservaPro_CL
description: |
  'This query searches for an service principal is not using a client certificate or secret is not secure. 
   It is recommended that you review your needs and use an Authentication method for sign-in.'  
kind: Scheduled
version: 1.0.1
status: Available
severity: High
relevantTechniques:
- T1078
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: D308318A-B298-4E57-82BD-74AE33C4A539

ARM