Add hunting queries: Entra ID identity boundary expansion hunting pack (3 queries)

[descambiado]

Summary

Three hunting queries targeting identity boundary expansion techniques in Entra ID. Each covers a distinct operation that shifts the permission surface without creating new accounts or directly adding credentials — making them harder to catch with account-focused detections.

Queries added

GuestUserTypeChangedToMember.yaml — T1098
Detects Update user events where UserType changes from Guest to Member. A guest-to-member conversion grants the account full tenant membership including access to internal resources, group memberships, and SharePoint sites that exclude guests. Rare in most tenants; correlate against help desk records if it fires.

ServicePrincipalOwnerAdded.yaml — T1098.001
Detects Add owner to service principal events. SP ownership silently grants full credential management rights — an actor who becomes SP owner can then add a password or certificate credential and authenticate as the SP without triggering the separate Add service principal credentials operation immediately. This is the documented precursor step in Midnight Blizzard-style persistence chains, and it sits in a detection gap between general role auditing and credential-focused detections.

ApplicationRedirectUriModified.yaml — T1528
Detects Update application events where the ReplyUrls field changes. Adding an attacker-controlled redirect URI to an existing trusted app registration allows interception of OAuth authorization codes from users who click legitimate consent flows pointing to that app. No new app registration is required, so first-seen-app detections miss it entirely.

What was verified

• No existing queries in Hunting Queries/ cover these three operations
• All descriptions ≤ 255 characters, start with "Identifies", sentence-case names
• OperationName =~ (exact match with in~/=~, no has_any)
• Direct InitiatedBy.user.userPrincipalName field access throughout, no parse_json(tostring(...)) wrapper
• No non-ASCII characters
• Three separate commits, one per query