Azure Activity Logs: Device or Device Configuration Modified or Deleted

Flags Azure audit events indicating device or device configuration updates or deletions.

FreeReviewedSigma · Medium · v5

Product: azure
Service: activitylogs
Author: Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published: 2021-09-03
Updated: 2026-07-31

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1485Data Destruction
- T1565.001Stored Data Manipulation

What it detects

This rule identifies Azure activity log events where a device or device configuration is updated or deleted. Adversaries may alter device posture or remove configuration to disrupt defenses or reduce the ability to detect and respond to activity. It relies on Azure Activity Logs capturing audit messages indicating delete or update operations for devices and device configurations.

Reporting behind it

Related detections9 linkedT1485 — drag to rearrange

Suspicious Self-Deleting Batch Script Execution Consistent with Agonizing Serpens Wiper Cleanup

Malicious Mass Device Wipe via Intune Remote Actions (via m365)

Malicious S3 Bucket Deletion During Bling Libra Extortion

Suspicious Modification of Windows Hosts File

Malicious DYNOWIPER PowerShell Loader Execution (via ps_script)

Suspicious S3 Lifecycle Policy Set for Rapid Object Deletion

Malicious PathWiper Loader Script Execution from Windows Temp via WScript

Suspicious Free Space Wipe via cipher.exe

Suspicious sha256sum.exe Execution from Windows Temp Directory

Azure Activity Logs: Device or Device Configuration Modified or Deleted

Pivot detection · T1485 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-activity-log-device-or-device-configuration-modified-or-deleted-46530378

title: "Azure Activity Logs: Device or Device Configuration Modified or Deleted"
id: 5d4a4235-8f74-44e6-99f8-b8ccaa6411c2
status: test
description: This rule identifies Azure activity log events where a device or device configuration is updated or deleted. Adversaries may alter device posture or remove configuration to disrupt defenses or reduce the ability to detect and respond to activity. It relies on Azure Activity Logs capturing audit messages indicating delete or update operations for devices and device configurations.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1485
  - attack.t1565.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    properties.message:
      - Delete device
      - Delete device configuration
      - Update device
      - Update device configuration
  condition: selection
falsepositives:
  - Device or device configuration being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 46530378-f9db-4af9-a9e5-889c177d3881
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL