Newly added Active Directory credentials
Your company uses SolarWinds Orion business software, which suffered the Sunburst Backdoor attack. You want to identify any lateral movement associated with attack by seeing if new Active Directory credentials have been granted to an existing service principal.
An Azure service principal is an identity that has access to an application, such as Active Directory.
Data required
Procedure
- Ensure you have installed the Microsoft Azure Add-on for Splunk.
- Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype="azure:aad:audit" activityDisplayName="Add service principal credentials"
Search explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
| Splunk Search | Explanation |
|---|---|
|
sourcetype="azure:aad:audit" |
Search only Azure Active Directory audit data. |
|
activityDisplayName="Add service principal credentials" |
Search for the "add service principal credentials" action. |
Next steps
After identifying new credentials added to existing service principals, you might also want to search for newly added service principals. Additionally, the Microsoft Azure Add-on for Splunk has searches and pre-built security content for Azure data that can help you interpret these results and take additional steps to resolve security concerns related to newly added Active Directory credentials.
You might also be interested in other processes associated with the Detecting lateral movement with Active Directory data use case.