Azure AD: Application Owner Added via Audit Log Message

Detects when an application owner is added in Azure audit logs, granting additional permissions to modify app configuration.

FreeReviewedSigma · Medium · v5

Product: azure
Service: auditlogs
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' (SigmaHQ), DRL 1.1
Published: 2022-06-02
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552Unsecured Credentials
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags audit log events where an application owner is added, identified by the message text "Add owner to application". Granting an owner role can enable the new account to modify application configuration, increasing attacker persistence and privilege within the tenant. It relies on Azure audit log telemetry capturing the specific operation message for owner changes.

Reporting behind it

Related detections9 linkedT1552 — drag to rearrange

Suspicious AWS API Call from TruffleHog Credential Scanner User Agent

Suspicious Access to IIS machine.config outside the Worker Process Context (via security)

Suspicious Bulk Mail and File Collection via MSGraph Application Access (via m365)

Suspicious Python Executing Script from var root Library Caches on macOS (via process_creation)

Malicious SD-WAN Compromise Credential Theft via loot_run.sh

Possible SSRF via VMware Workspace One Access instanceHealth CVE-2021-22056

Suspicious Azure Credential Hunting via MicroBurst Modules

Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner

Linux Script Interpreters Spawning Credential Scanners (trufflehog, gitleaks)

Azure AD: Application Owner Added via Audit Log Message

Pivot detection · T1552 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-ad-audit-log-owner-added-to-application-74298991

title: "Azure AD: Application Owner Added via Audit Log Message"
id: 115f1187-0416-4620-9029-2c945563be47
status: test
description: This rule flags audit log events where an application owner is added, identified by the message text "Add owner to application". Granting an owner role can enable the new account to modify application configuration, increasing attacker persistence and privilege within the tenant. It relies on Azure audit log telemetry capturing the specific operation message for owner changes.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_owner_added.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-02
tags:
  - attack.t1552
  - attack.credential-access
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Add owner to application
  condition: selection
falsepositives:
  - When a new application owner is added by an administrator
level: medium
license: DRL-1.1
related:
  - id: 74298991-9fc4-460e-a92e-511aa60baec1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL