Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when a user account adds a federated identity credential (FIC) to an application registration. This may indicate an attacker preparing to use an application for privilege escalation or persistence.

Strategy

Monitor Microsoft Entra ID audit logs for the following event, Update application, where the modifiedProperties of the event contains FederatedIdentityCredentials. For further information on attacks using federated credentials, review [Persisting on Entra ID applications and User Managed Identities with Federated Credentials][1].

Triage and response

1. Determine if this user was expected to manage this application.
2. Check for other signals and logs generated by the impacted user {{@usr.id}}, and look for deviations in the following properties:
   • Application
   • Device
   • Geolocation
   • IP address
   • User agent
3. Reach out to the user {{@usr.id}} to confirm if they recognize the activity.
4. If the activity is not legitimate:
   • Remove the suspicious key.
   • Invalidate all existing refresh tokens.
   • Initiate your incident response process for further investigation.

[1] https://dirkjanm.io/persisting-with-federated-credentials-entra-apps-managed-identities/