← Back to SOC feed Coverage →

Dormant Service Principal Update Creds and Logs In

kql MEDIUM Azure-Sentinel
T1098
AuditLogsSigninLogs
credential-thefthuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-06-02T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may update credentials for dormant service principals to re-enable them and gain unauthorized access to Azure resources. SOC teams should proactively hunt for this behavior as it indicates potential credential reuse or persistence tactics by threat actors.

KQL Query

let starttime = todatetime('{{StartTimeISO}}');
let endtime = todatetime('{{EndTimeISO}}');
let lookback = endtime - 14d;
let sp_active_users = AADServicePrincipalSignInLogs
| where TimeGenerated between(lookback..starttime)
| where ResultType  == 0
| summarize by ServicePrincipalId;
AuditLogs
| where TimeGenerated between(starttime..endtime)
// Looking for new creds added to an SP rather than MFA
| where OperationName in ("Add service principal credentials", "Update application - Certificates and secrets management")
| extend ServicePrincipalId = tostring(TargetResources[0].id)
| where ServicePrincipalId !in (sp_active_users)
| join kind=inner (SigninLogs | where TimeGenerated between(starttime..endtime) | where ResultType == 0) on ServicePrincipalId
| extend AccountCustomEntity = ServicePrincipalId, IPCustomEntity = IPAddress

Analytic Rule Definition

id: e7cdfacc-d112-45c7-9e8f-2b52948d075c
name: Dormant Service Principal Update Creds and Logs In
description: |
  'This query look for Service Principal accounts that are no longer used where a user has added or updated credentials for them before logging in with the Service Principal.
   Threat actors may look to re-activate dormant accounts and use them for access in the hope that changes to such dormant accounts may go un-noticed.'
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
      - AADServicePrincipalSignInLogs
tactics:
  - Persistence
relevantTechniques:
  - T1098
query: |
  let starttime = todatetime('{{StartTimeISO}}');
  let endtime = todatetime('{{EndTimeISO}}');
  let lookback = endtime - 14d;
  let sp_active_users = AADServicePrincipalSignInLogs
  | where TimeGenerated between(lookback..starttime)
  | where ResultType  == 0
  | summarize by ServicePrincipalId;
  AuditLogs
  | where TimeGenerated between(starttime..endtime)
  // Looking for new creds added to an SP rather than MFA
  | where OperationName in ("Add service principal credentials", "Update application - Certificates and secrets management")
  | extend ServicePrincipalId = tostring(TargetResources[0].id)
  | where ServicePrincipalId !in (sp_active_users)
  | join kind=inner (SigninLogs | where TimeGenerated between(starttime..endtime) | where ResultType == 0) on ServicePrincipalId
  | extend AccountCustomEntity = ServicePrincipalId, IPCustomEntity = IPAddress
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity

Required Data Sources

Sentinel TableNotes
AuditLogsEnsure this data connector is enabled
SigninLogsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/MultipleDataSources/DormantServicePrincipalUpdateCredsandLogsIn.yaml