Secret Exposure with Anomalous SPN Sign-In

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index


Detects applications with open hardcoded-secret findings (CWE-798, CWE-259, CWE-321, CWE-522) that have associated service principal sign-in anomalies. Correlates StratoSecure secret findings with AAD SPN sign-in failures.

Attribute Value
Type Analytic Rule
Solution StratoSecure
ID a91e677a-46b5-428e-8a7d-29a2bb33bb6f
Severity High
Status Available
Kind Scheduled
Tactics CredentialAccess, DefenseEvasion
Techniques T1552, T1078.004
Required Connectors StratoSecurePush
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
AADServicePrincipalSignInLogs ✓ ✗ ✓
StratoSecure_Findings_CL ? ✓ ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to StratoSecure