Azure Activity Logs: Device or Device Configuration Modified or Deleted

title: "Azure Activity Logs: Device or Device Configuration Modified or Deleted"
id: 5d4a4235-8f74-44e6-99f8-b8ccaa6411c2
status: test
description: This rule identifies Azure activity log events where a device or device configuration is updated or deleted. Adversaries may alter device posture or remove configuration to disrupt defenses or reduce the ability to detect and respond to activity. It relies on Azure Activity Logs capturing audit messages indicating delete or update operations for devices and device configurations.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1485
  - attack.t1565.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    properties.message:
      - Delete device
      - Delete device configuration
      - Update device
      - Update device configuration
  condition: selection
falsepositives:
  - Device or device configuration being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 46530378-f9db-4af9-a9e5-889c177d3881
    type: derived