↳ GitHub sourceAnalytics ruleMedium

ContraForce - Machine credential activity

Description

'Identifies service-account and machine-credential lifecycle activity in the ContraForce workspace: service accounts created or deleted, credentials created, regenerated or revoked, and API client secret regenerations. Machine credentials grant standing programmatic access, so unexpected lifecycle events can indicate persistence being established or an attempt to rotate credentials out from under their legitimate owner.'

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 5m
Query period: 1d
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

ContraForceEvents

Data types

ContraForceEvents_CL

KQL query

Original query, unchanged.

ContraForceEvents_CL
| where ingestion_time() > ago(5m)
| where ActivityType in ("ServiceAccountCreated", "ServiceAccountDeleted", "ServiceAccountCredentialCreated", "ServiceAccountCredentialRegenerated", "ServiceAccountCredentialRevoked", "ApiClientSecretRegenerated")
| extend Meta = parse_json(Metadata)
| project TimeGenerated, EventId, CfWorkspaceId, ActivityType, ActivityAction,
          ActorName, ActorEmail, TargetResourceType, TargetResourceId, TargetResourceName, Metadata

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/ContraForce/Analytic Rules/ContraForceMachineCredentialActivity.yaml ↗
Commit: 9800e51 ↗
Source identifier: 8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52

Additional source files 2

Solutions/ContraForce/Analytic Rules/ContraForceMachineCredentialActivity.yamlsource ↗Solutions/ContraForce/Data/Solution_ContraForce.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.