EIDAPP-004: First-Party Microsoft Service Principals with Added Credentials
- Plataforma
- Entra ID / M365
- Categoría
- Consent
- Severidad
- Critical
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Attackers add credentials to Microsoft first-party service principals to establish persistent backdoor access that blends in with legitimate Microsoft services. Because first-party service principals are trusted by default and often hold extensive permissions, added credentials on these objects provide stealthy, high-privilege persistence that is rarely audited. Any credential additions to first-party Microsoft service principals should be treated as a critical indicator of compromise.
Valor recomendado
No credentials (secrets or certificates) added to any first-party Microsoft service principals
Remediación
Enumerate all service principals where the appOwnerOrganizationId matches the Microsoft tenant ID (f8cdef31-a31e-4b4a-93e4-5f571e91255a) and check for added key credentials or password credentials. Remove any credentials found on first-party Microsoft service principals immediately as these are almost certainly unauthorized. Investigate the audit logs to determine who added the credentials and when, treating this as a potential security incident.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5
- MITRE ATT&CK
- T1098.001