detect-entra-credential-addition

Attack pattern

This detector covers one narrow Entra persistence slice:

• Add service principal credentials
• Update application - Certificates and secrets management
• Create federated identity credential
• Add federated identity credential

All of these actions create or rotate credential material or trust paths for an application or service principal. In ATT&CK terms, that maps cleanly to T1098.001 Additional Cloud Credentials.

This first slice intentionally does not cover: