Azure Service Principal Credential Added

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects when a credential (password) is added to an Azure Service Principal. This activity is identified by monitoring HTTP traffic for requests to 'graph.microsoft.com' containing 'addPassword' in the URI. This could indicate an attacker establishing persistence by adding new credentials to an existing service principal.