Added Credentials to Existing Azure Application or Service Principal

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•34

Detects when new credentials (certificates or secrets) are added to an existing application or service principal within Azure/Entra ID. This activity, if not part of expected workflows, could indicate a malicious actor establishing persistence or escalating privileges by adding their own credentials to an application.