KQL Search

Query Details

Unusual Addition of Credentials to an OAuth Application

Unusual Addition Of Credentials To An Oauth App

Query

BehaviorInfo
| where ActionType == "UnusualAdditionOfCredentialsToAnOauthApp"
| project TimeGenerated, ActionType, BehaviorId, AccountObjectId, AccountUpn
| join kind=inner (BehaviorEntities | where EntityType == "OAuthApplication" and EntityRole == "Related") on BehaviorId
| extend AppPermissions = parse_json(AdditionalFields).Permissions
| project-rename Actor = AccountUpn, ActorObjectId = AccountObjectId, ImpactedApplication = Application, ImpactedApplicationId = ApplicationId
| project-reorder TimeGenerated, ActionType, Actor, ActorObjectId, ImpactedApplication, ImpactedApplicationId, AppPermissions

About this query

Unusual Addition of Credentials to an OAuth Application

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink
T1098.001Account Manipulation: Additional Cloud Credentialshttps://attack.mitre.org/techniques/T1098/001/

Description

Detects unusual additions of credentials to an OAuth application. The query identifies the actor, affected application, and permissions assigned to the new credential.

Risk

An attacker who adds a credential to an OAuth application can retain persistent access and use the application's permissions to access cloud resources.

References

Sentinel

Explanation

This query is designed to detect suspicious activities related to the addition of credentials to OAuth applications, which could indicate a security threat. Here's a simple breakdown of what the query does:

  1. Data Source: It starts by looking at a data source called BehaviorInfo to find any actions labeled as "UnusualAdditionOfCredentialsToAnOauthApp". This indicates that someone has added credentials to an OAuth application in a way that is considered unusual or potentially malicious.

  2. Data Joining: The query then joins this information with another data source, BehaviorEntities, to get more details about the OAuth application involved. It specifically looks for entries where the entity type is "OAuthApplication" and the role is "Related".

  3. Extracting Permissions: It extracts the permissions associated with the new credentials from a field called AdditionalFields and stores them in a new field called AppPermissions.

  4. Renaming and Organizing Data: The query renames some fields for clarity:

    • AccountUpn becomes Actor, representing the user who performed the action.
    • AccountObjectId becomes ActorObjectId.
    • Application becomes ImpactedApplication.
    • ApplicationId becomes ImpactedApplicationId.

  5. Final Output: The final output is a table that shows:

    • The time the action was detected (TimeGenerated).
    • The type of action (ActionType).
    • The actor who performed the action (Actor and ActorObjectId).
    • The application affected by the action (ImpactedApplication and ImpactedApplicationId).
    • The permissions assigned to the new credential (AppPermissions).

Overall, this query helps security teams identify and investigate potential security incidents where unauthorized credentials are added to OAuth applications, which could allow attackers to access cloud resources using the application's permissions.