Built a rule pack for Azure service principals. Too many orgs treat them as trusted identities without monitoring. These rules catch high-risk actions and misconfigurations.
Focuses on:
* Service principal credential addition/rotation (potential persistence)
* Application administrator role assignments (excessive privilege)
* Suspicious OAuth2 permission grants (consent phishing)
* Dangerous credential types (certificates, client secrets)
Example rule for detecting new credentials:
```json
{
"rule_id": "azure_sp_new_credential",
"description": "A new credential (password or certificate) was added to a service principal.",
"index": ["logs-azure*"],
"query": "event.provider:"Azure Active Directory" AND event.category:ServicePrincipal AND event.action:(AddPassword OR AddKey)",
"severity": "high",
"risk_score": 70
}
```
Pack includes 12 rules, pre-built exceptions for known CI/CD principals, and maps to MITRE ATT&CK.