Add Azure AD Entra ID identity attack detections (3 analytics)

[descambiado]

Details

Three new TTP analytics covering Azure AD / Entra ID identity attack techniques that are not currently in the repository.

azure_ad_temporary_access_pass_created.yml
Detects creation of a Temporary Access Pass for an Azure AD user via the Create Temporary Access Pass method for user AuditLog operation. TAPs are time-limited passcodes that bypass MFA and FIDO2 — an attacker who gains admin access and creates a TAP for a target account can authenticate without any second factor. Covers T1556.006, T1078.004. Risk score 70 on targetUser.

azure_ad_guest_user_type_changed_to_member.yml
Detects when a guest account's UserType property is changed to Member via Update user. Uses mvfind/mvindex to filter on the UserType modifiedProperty, consistent with the pattern used in azure_ad_block_user_consent_for_risky_apps_disabled. Removing guest restrictions gives a compromised external identity broader access to tenant resources. Covers T1098.

azure_ad_federated_identity_credential_added_to_sp.yml
Detects federated identity credential additions to service principals via Update service principal where FederatedIdentityCredentials appears in modifiedProperties. Workload identity federation allows external OIDC workloads (GitHub Actions, Kubernetes) to authenticate as the SP without a secret — an attacker who adds a federated credential pointing to a controlled OIDC issuer gains a persistent secretless authentication path invisible to standard credential monitoring. Covers T1098.001.

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature (azure_ad prefix, descriptive name consistent with existing detections)
• CI/CD jobs passed - pending (see notes)
• Validated SPL logic against Azure AD AuditLogs schema
• Validated tags, description, and how_to_implement
• Verified references match analytic
• No lookup changes

Notes For Submitters and Reviewers

CLA: I have not yet signed the Splunk individual contributors agreement. I will complete this at https://www.splunk.com/goto/individualcontributions before this PR is reviewed.

Attack data: Test data files for these three techniques do not yet exist in splunk/attack_data. The tests.attack_data URLs follow the established naming pattern but point to datasets that need to be contributed separately. Happy to contribute the attack data in a follow-up PR to splunk/attack_data once the detection logic is reviewed and approved.

SPL pattern: The azure_ad_guest_user_type_changed_to_member and azure_ad_federated_identity_credential_added_to_sp analytics use the mvfind/mvindex pattern for modifiedProperties array filtering, consistent with azure_ad_block_user_consent_for_risky_apps_disabled.