title: Credential Added to Application or Service Principal
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c04
status: experimental
description: A secret or certificate was added to an application or service principal. Storm-0940 added credentials to OAuth applications for persistence; these survive disabling the original ConnectWise app. Review all events since 15 Oct 2026.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
    - https://www.connectwise.com/contentassets/10777cd3364d440c86ed5270a94a5f24/connectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdf
author: Cybaverse
date: 2026-10-22
tags:
    - attack.persistence
    - attack.t1098.001
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        OperationName:
            - 'Add service principal credentials'
            - 'Update application – Certificates and secrets management'
            - 'Update application - Certificates and secrets management'
    condition: selection
falsepositives:
    - Planned secret or certificate rotation
level: medium