Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects an Azure service principal being re-enabled after previously being disabled.

Strategy

This rule monitors Microsoft Entra audit logs where @ocsf.metadata.event_code is "Update service principal" and @properties.targetResources.modifiedProperties.displayName is AccountEnabled, with @properties.targetResources.modifiedProperties.oldValue of [false] transitioning to @properties.targetResources.modifiedProperties.newValue of [true].

Triage and response

• Identify the administrator {{@ocsf.actor.user.uid}} who re-enabled the service principal and verify whether they have a documented reason for the change, such as planned remediation or an application migration.
• Review the service principal’s @properties.targetResources.displayName and @properties.targetResources.id to determine which application or integration it belongs to and whether it is still expected to be in use.
• Determine why the service principal was originally disabled by reviewing prior "Update service principal" audit events for the same @properties.targetResources.id, including any security investigation or incident that led to the disablement.
• Examine the service principal’s assigned permissions, role assignments, and credentials (client secrets or certificates) for signs of unauthorized modification.
• Check for suspicious sign-in or API activity from the service principal to confirm whether it is being used for legitimate purposes.