mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
62 lines
2.4 KiB
Markdown
62 lines
2.4 KiB
Markdown
# Azure Service Principal Abuse Detection — API Reference
|
|
|
|
## Libraries
|
|
|
|
| Library | Install | Purpose |
|
|
|---------|---------|---------|
|
|
| azure-identity | `pip install azure-identity` | Azure AD authentication |
|
|
| requests | `pip install requests` | Microsoft Graph API client |
|
|
|
|
## Microsoft Graph API Endpoints
|
|
|
|
| Method | Endpoint | Description |
|
|
|--------|----------|-------------|
|
|
| GET | `/v1.0/servicePrincipals` | List service principals |
|
|
| GET | `/v1.0/servicePrincipals/{id}` | Get SP details and credentials |
|
|
| GET | `/v1.0/servicePrincipals/{id}/appRoleAssignments` | SP role assignments |
|
|
| GET | `/v1.0/directoryRoles` | List directory roles |
|
|
| GET | `/v1.0/directoryRoles/{id}/members` | Role members (includes SPs) |
|
|
| GET | `/v1.0/auditLogs/signIns` | Sign-in logs for SP activity |
|
|
| GET | `/v1.0/auditLogs/directoryAudits` | Directory change audit logs |
|
|
|
|
## OAuth2 Token Endpoint
|
|
|
|
```
|
|
POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
|
|
grant_type=client_credentials
|
|
scope=https://graph.microsoft.com/.default
|
|
```
|
|
|
|
## High-Privilege Directory Roles
|
|
|
|
| Role | Risk |
|
|
|------|------|
|
|
| Global Administrator | Full tenant control |
|
|
| Application Administrator | Can create/manage all apps |
|
|
| Cloud Application Administrator | Manage cloud app registrations |
|
|
| Privileged Role Administrator | Manage role assignments |
|
|
|
|
## Service Principal Abuse Indicators
|
|
|
|
| Indicator | Description | Severity |
|
|
|-----------|-------------|----------|
|
|
| Multiple password credentials | Possible backdoor persistence | HIGH |
|
|
| Expired credentials not removed | Credential hygiene gap | MEDIUM |
|
|
| SP with Global Admin role | Overprivileged automation | CRITICAL |
|
|
| Unusual sign-in location | Compromised SP credentials | HIGH |
|
|
| New credential added to SP | Persistence via credential injection | CRITICAL |
|
|
|
|
## MITRE ATT&CK Mapping
|
|
|
|
| Technique | ID | Description |
|
|
|-----------|----|-------------|
|
|
| Account Manipulation | T1098 | Add credentials to SP |
|
|
| Valid Accounts: Cloud | T1078.004 | Abuse SP credentials |
|
|
| Trusted Relationship | T1199 | Abuse multi-tenant SP trust |
|
|
|
|
## External References
|
|
|
|
- [Microsoft Graph API: Service Principals](https://learn.microsoft.com/en-us/graph/api/resources/serviceprincipal)
|
|
- [Azure AD Sign-in Logs](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins)
|
|
- [Detecting Azure AD Backdoors](https://posts.specterops.io/)
|