Azure AD Service Principal Credential Addition Detected
This rule detects successful additions or updates to service principal credentials or application certificates/secrets within Azure AD. This activity can indicate persistence establishment by an attacker who has compromised an account with sufficient permissions to manipulate application identities.
Microsoft Sentinel (KQL)
