Detectionmediumtest

Azure Application Deleted

Identifies when a application is deleted in Azure.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Austin SongerCreated Fri Sep 03Updated Sun Oct 09410d2a41-1e6d-452f-85e5-abdd8257a823cloud

Log Source

Azureactivitylogs

ProductAzure← raw: azure

Serviceactivitylogs← raw: activitylogs

Detection Logic

detection:
    selection:
        properties.message:
            - Delete application
            - Hard Delete application
    condition: selection

False Positives

Application being deleted may be performed by a system administrator.

Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

410d2a41-1e6d-452f-85e5-abdd8257a823

Status

test

Level

medium

Type

Detection

Created

Fri Sep 03

Modified

Sun Oct 09

Author

Path

rules/cloud/azure/activity_logs/azure_application_deleted.yml

Raw Tags

attack.defense-evasionattack.impactattack.t1489