EIDAPP-003: App Registrations with Added Credentials
- Platform
- Entra ID / M365
- Category
- Consent
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Application registrations with client secrets or certificates added represent potential persistence mechanisms for attackers. A compromised secret or certificate allows an attacker to authenticate as the application and exercise all of its granted permissions without user interaction. Credentials should be inventoried, rotated on schedule, and removed when no longer needed to limit the window of exposure.
Recommended value
All application credentials inventoried with defined rotation schedules and no credentials older than 12 months
Remediation
Review all application registrations and examine the Certificates & secrets blade for each. Document all active credentials including their expiration dates and creation timestamps. Remove expired or unused credentials immediately and establish a rotation policy requiring credentials to be renewed at least annually with automated alerts before expiration.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.5.5v1
- NIST SP 800-53
- IA-5
- MITRE ATT&CK
- T1098.001
Zero analytics. Zero tracking. Zero cookies. This site makes no external requests, so there is nothing to consent to.
Guerrilla is free and open source. · Validation
Guerrilla is written and maintained by Jim Tyler. This copy lives on jimtyler.org; the project also publishes at guerrilla.army.