Add uncommon credential type to application [Nobelium]

id: 63a191f4-a0ad-4ed7-b994-24ffc89b3596
name: Add uncommon credential type to application [Nobelium]
description: |
  The query looks for users or service principals that attached an uncommon credential type to application.
  As part of the Nobelium campaign, the attacker added credentials to already existing applications and used the application permissions to extract users' mails.
  See How to: Use the portal to create an Microsoft Entra ID application and service principal that can access resources.
  Reference - https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- Privilege escalation
tags:
- Nobelium
query: |
  CloudAppEvents
  | where Application == "Office 365"
  | where ActionType in ("Add service principal credentials.", "Update application - Certificates and secrets management ")
  | project Timestamp, RawEventData, AccountDisplayName, ActionType, AccountObjectId
  | extend ModifiedProperties = RawEventData.ModifiedProperties[0]
  | extend NewValue = ModifiedProperties.NewValue, OldValue = ModifiedProperties.OldValue, Name = ModifiedProperties.Name
  | project Timestamp, AccountDisplayName, ActionType, NewValue, OldValue, RawEventData, AccountObjectId
  | where (NewValue has "KeyType=Password" and OldValue !has "KeyType=Password" and OldValue has "AsymmetricX509Cert") or (NewValue has "AsymmetricX509Cert" and OldValue !has "AsymmetricX509Cert" and OldValue has "KeyType=Password")
  | extend NewSecret = set_difference(todynamic(parse_json(tostring(NewValue))), todynamic(parse_json(tostring(OldValue))))
  | project Timestamp,ActionType,ActorType = RawEventData.Actor[-1].ID, ObjectId = RawEventData.Actor[-2].ID, AccountDisplayName, AccountObjectId, AppnName = RawEventData.Target[3].ID, AppObjectId = RawEventData.Target[1].ID, NewSecret = NewSecret[0], RawEventData