Azure AD Audit Log: Owner Added to Application

Detects when an application owner is added in Azure audit logs, granting additional permissions to modify app configuration.

FreeUnreviewedSigmamediumv1

azure-ad-audit-log-owner-added-to-application-74298991

title: "Azure AD Audit Log: Owner Added to Application"
id: 115f1187-0416-4620-9029-2c945563be47
status: test
description: This rule flags events where an application owner is added, specifically messages matching “Add owner to application.” Adding an owner grants the specified account permission to modify and configure the application, which can enable persistence or configuration changes. It relies on Azure audit log messages from the application owner add action.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_owner_added.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-02
tags:
  - attack.t1552
  - attack.credential-access
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Add owner to application
  condition: selection
falsepositives:
  - When a new application owner is added by an administrator
level: medium
license: DRL-1.1
related:
  - id: 74298991-9fc4-460e-a92e-511aa60baec1
    type: derived

What it detects

This rule flags events where an application owner is added, specifically messages matching “Add owner to application.” Adding an owner grants the specified account permission to modify and configure the application, which can enable persistence or configuration changes. It relies on Azure audit log messages from the application owner add action.

Known false positives

When a new application owner is added by an administrator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.