Common Information
| Type | Value |
|---|---|
| Value |
AZT602 - Steal Service Principal Certificate |
| Category | Atrm |
| Type | Atrm |
| Misp Type | Cluster |
| Description | If a Runbook is utilizing a 'RunAs' account, then an adversary may manipulate the Runbook to reveal the certificate the Service Principal is using for authentication. |