2026 Critical Enterprise Intrusion Chain Detection: New Credential Added to Cloud Service Principal/App Registration
Detects the addition of new credentials (certificates, secrets, or keys) to Azure AD Service Principals or Applications, occurring outside of standard business hours (6 AM to 8 PM). This pattern is often indicative of an adversary establishing or maintaining persistent access to an enterprise cloud environment.
Cortex XDR
