Azure Activity Log: Device or Device Configuration Modified or Deleted

Flags Azure audit events indicating device or device configuration updates or deletions.

FreeUnreviewedSigmamediumv1

azure-activity-log-device-or-device-configuration-modified-or-deleted-46530378

title: "Azure Activity Log: Device or Device Configuration Modified or Deleted"
id: 5d4a4235-8f74-44e6-99f8-b8ccaa6411c2
status: test
description: This rule identifies Azure activity log events where a device or device configuration is updated or deleted. Attackers may tamper with device and configuration objects to disrupt access, degrade security controls, or impact identity posture. It relies on Azure Activity Logs telemetry capturing event messages for device and device configuration create/update/delete actions, matched by specific message text.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1485
  - attack.t1565.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    properties.message:
      - Delete device
      - Delete device configuration
      - Update device
      - Update device configuration
  condition: selection
falsepositives:
  - Device or device configuration being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 46530378-f9db-4af9-a9e5-889c177d3881
    type: derived

What it detects

This rule identifies Azure activity log events where a device or device configuration is updated or deleted. Attackers may tamper with device and configuration objects to disrupt access, degrade security controls, or impact identity posture. It relies on Azure Activity Logs telemetry capturing event messages for device and device configuration create/update/delete actions, matched by specific message text.

Known false positives

Device or device configuration being modified or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.