Service Principal Assigned App Role With Sensitive Access

Back


Id	dd78a122-d377-415a-afe9-f22e08d2112c
Rulename	Service Principal Assigned App Role With Sensitive Access
Description	Detects a Service Principal being assigned an app role that has sensitive access such as Mail.Read. A threat actor who compromises a Service Principal may assign it an app role to allow it to access sensitive data, or to perform other actions. Ensure that any assignment to a Service Principal is valid and appropriate. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions
Severity	Medium
Tactics	PrivilegeEscalation
Techniques	T1078.004
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ServicePrincipalAssignedAppRoleWithSensitiveAccess.yaml
Version	1.0.3
Arm template	dd78a122-d377-415a-afe9-f22e08d2112c.json

KQL

// Add other permissions to this list as needed
  let permissions = dynamic(["Mail.Read", "offline_access", "Files.Read", "Notes.Read", "ChannelMessage.Read", "Chat.Read", "TeamsActivity.Read",
  "Group.Read", "EWS.AccessAsUser.All", "EAS.AccessAsUser.All"]);
  AuditLogs
  | where OperationName =~ "Add app role assignment to service principal"
  | mv-expand TargetResources[0].modifiedProperties
  | extend TargetResources_0_modifiedProperties = column_ifexists("TargetResources_0_modifiedProperties", '')
  | where isnotempty(TargetResources_0_modifiedProperties)
  | where TargetResources_0_modifiedProperties.displayName =~ "AppRole.Value" or TargetResources_0_modifiedProperties.displayName =~ "DelegatedPermissionGrant.Scope"
  | extend Permissions = split((parse_json(tostring(TargetResources_0_modifiedProperties.newValue))), " ")
  | where Permissions has_any (permissions)
  | summarize AddedPermissions=make_set(Permissions,200) by CorrelationId
  | join kind=inner (AuditLogs
  | where OperationName =~ "Add app role assignment to service principal") on CorrelationId
  | extend InitiatedBy = tostring(iff(isnotempty(InitiatedBy.user.userPrincipalName),InitiatedBy.user.userPrincipalName, InitiatedBy.app.displayName))
  | extend ServicePrincipal = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[4].newValue)))
  | extend SPID = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[6].newValue)))
  | extend InitiatedBy = pack("User", InitiatedBy, "UA", column_ifexists("UserAgent",''), "IPAddress", column_ifexists("IpAddress",''))
  | mv-expand kind=array AddedPermissions
  | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), make_set(InitiatedBy,200), make_set(AddedPermissions,200) by SPID, ServicePrincipal

YAML

tags:
- AADSecOpsGuide
name: Service Principal Assigned App Role With Sensitive Access
requiredDataConnectors:
- dataTypes:
  - AuditLogs
  connectorId: AzureActiveDirectory
id: dd78a122-d377-415a-afe9-f22e08d2112c
tactics:
- PrivilegeEscalation
queryFrequency: 1d
triggerOperator: gt
metadata:
  author:
    name: Pete Bryan
  support:
    tier: Community
  categories:
    domains:
    - Security - Others
    - Identity
  source:
    kind: Community
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ServicePrincipalAssignedAppRoleWithSensitiveAccess.yaml
description: |
  'Detects a Service Principal being assigned an app role that has sensitive access such as Mail.Read.
    A threat actor who compromises a Service Principal may assign it an app role to allow it to access sensitive data, or to perform other actions.
    Ensure that any assignment to a Service Principal is valid and appropriate.
    Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions'  
triggerThreshold: 0
kind: Scheduled
relevantTechniques:
- T1078.004
query: |
  // Add other permissions to this list as needed
    let permissions = dynamic(["Mail.Read", "offline_access", "Files.Read", "Notes.Read", "ChannelMessage.Read", "Chat.Read", "TeamsActivity.Read",
    "Group.Read", "EWS.AccessAsUser.All", "EAS.AccessAsUser.All"]);
    AuditLogs
    | where OperationName =~ "Add app role assignment to service principal"
    | mv-expand TargetResources[0].modifiedProperties
    | extend TargetResources_0_modifiedProperties = column_ifexists("TargetResources_0_modifiedProperties", '')
    | where isnotempty(TargetResources_0_modifiedProperties)
    | where TargetResources_0_modifiedProperties.displayName =~ "AppRole.Value" or TargetResources_0_modifiedProperties.displayName =~ "DelegatedPermissionGrant.Scope"
    | extend Permissions = split((parse_json(tostring(TargetResources_0_modifiedProperties.newValue))), " ")
    | where Permissions has_any (permissions)
    | summarize AddedPermissions=make_set(Permissions,200) by CorrelationId
    | join kind=inner (AuditLogs
    | where OperationName =~ "Add app role assignment to service principal") on CorrelationId
    | extend InitiatedBy = tostring(iff(isnotempty(InitiatedBy.user.userPrincipalName),InitiatedBy.user.userPrincipalName, InitiatedBy.app.displayName))
    | extend ServicePrincipal = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[4].newValue)))
    | extend SPID = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[6].newValue)))
    | extend InitiatedBy = pack("User", InitiatedBy, "UA", column_ifexists("UserAgent",''), "IPAddress", column_ifexists("IpAddress",''))
    | mv-expand kind=array AddedPermissions
    | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), make_set(InitiatedBy,200), make_set(AddedPermissions,200) by SPID, ServicePrincipal  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ServicePrincipal
    identifier: Name
- entityType: Account
  fieldMappings:
  - columnName: SPID
    identifier: AadUserId
severity: Medium
version: 1.0.3
queryPeriod: 1d

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dd78a122-d377-415a-afe9-f22e08d2112c')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dd78a122-d377-415a-afe9-f22e08d2112c')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Service Principal Assigned App Role With Sensitive Access",
        "description": "'Detects a Service Principal being assigned an app role that has sensitive access such as Mail.Read.\n  A threat actor who compromises a Service Principal may assign it an app role to allow it to access sensitive data, or to perform other actions.\n  Ensure that any assignment to a Service Principal is valid and appropriate.\n  Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "// Add other permissions to this list as needed\n  let permissions = dynamic([\"Mail.Read\", \"offline_access\", \"Files.Read\", \"Notes.Read\", \"ChannelMessage.Read\", \"Chat.Read\", \"TeamsActivity.Read\",\n  \"Group.Read\", \"EWS.AccessAsUser.All\", \"EAS.AccessAsUser.All\"]);\n  AuditLogs\n  | where OperationName =~ \"Add app role assignment to service principal\"\n  | mv-expand TargetResources[0].modifiedProperties\n  | extend TargetResources_0_modifiedProperties = column_ifexists(\"TargetResources_0_modifiedProperties\", '')\n  | where isnotempty(TargetResources_0_modifiedProperties)\n  | where TargetResources_0_modifiedProperties.displayName =~ \"AppRole.Value\" or TargetResources_0_modifiedProperties.displayName =~ \"DelegatedPermissionGrant.Scope\"\n  | extend Permissions = split((parse_json(tostring(TargetResources_0_modifiedProperties.newValue))), \" \")\n  | where Permissions has_any (permissions)\n  | summarize AddedPermissions=make_set(Permissions,200) by CorrelationId\n  | join kind=inner (AuditLogs\n  | where OperationName =~ \"Add app role assignment to service principal\") on CorrelationId\n  | extend InitiatedBy = tostring(iff(isnotempty(InitiatedBy.user.userPrincipalName),InitiatedBy.user.userPrincipalName, InitiatedBy.app.displayName))\n  | extend ServicePrincipal = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[4].newValue)))\n  | extend SPID = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[6].newValue)))\n  | extend InitiatedBy = pack(\"User\", InitiatedBy, \"UA\", column_ifexists(\"UserAgent\",''), \"IPAddress\", column_ifexists(\"IpAddress\",''))\n  | mv-expand kind=array AddedPermissions\n  | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), make_set(InitiatedBy,200), make_set(AddedPermissions,200) by SPID, ServicePrincipal\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078.004"
        ],
        "alertRuleTemplateName": "dd78a122-d377-415a-afe9-f22e08d2112c",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "ServicePrincipal"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "identifier": "AadUserId",
                "columnName": "SPID"
              }
            ],
            "entityType": "Account"
          }
        ],
        "templateVersion": "1.0.3",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ServicePrincipalAssignedAppRoleWithSensitiveAccess.yaml",
        "tags": [
          "AADSecOpsGuide"
        ]
      }
    }
  ]
}