Added Credentials to Existing Application

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

title: Added Credentials to Existing Application
id: cbb67ecc-fb70-4467-9350-c910bdf7c628
status: test
description: Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022-05-26
modified: 2026-08-20
tags:
    - attack.privilege-escalation
    - attack.t1098.001
    - attack.persistence
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message:
            - 'Update application - Certificates and secrets management' # See https://github.com/SigmaHQ/sigma/pull/6247#issuecomment-5463002942
            - 'Update Service principal/Update Application'
    condition: selection
falsepositives:
    - When credentials are added/removed as part of the normal working hours/workflows
level: high

• T1098.001Additional Cloud Credentials

• https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials↗