Leaked App Secret - TruffleHog User-Agent in AAD Service Principal Sign-in Logs
This rule detects sign-in attempts to Azure Active Directory (AAD) service principals where the User-Agent string contains "TruffleHog". TruffleHog is an open-source tool used for finding sensitive data (like credentials) in various data sources. Its presence in AAD sign-in logs, especially for service principals, could indicate an attempt to scan for or verify leaked secrets or credentials associated with service accounts.
Microsoft Sentinel (KQL)
