Azure AD Audit Logs: AppID URI configuration updates for applications or service principals

Alerts on Azure audit log entries indicating updates to an application or service principal AppID URI configuration.

FreeUnreviewedSigmahighv1

azure-ad-audit-logs-appid-uri-configuration-updates-for-applications-or-service--1b45b0d1

title: "Azure AD Audit Logs: AppID URI configuration updates for applications or service principals"
id: d44cb102-d13e-4f3f-9143-e7a3ae77e378
status: test
description: This rule flags audit log events where an application AppID URI is updated, indicated by messages for “Update Application” or “Update Service principal.” AppID URI changes can enable identity-related access patterns that attackers may use for persistence or privilege escalation, making change monitoring important. Detection relies on Azure audit log message text captured in auditlogs telemetry.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-02
tags:
  - attack.initial-access
  - attack.persistence
  - attack.credential-access
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1552
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
      - Update Application
      - Update Service principal
  condition: selection
falsepositives:
  - When and administrator is making legitimate AppID URI configuration changes to an application. This should be a planned event.
level: high
license: DRL-1.1
related:
  - id: 1b45b0d1-773f-4f23-aedc-814b759563b1
    type: derived

What it detects

This rule flags audit log events where an application AppID URI is updated, indicated by messages for “Update Application” or “Update Service principal.” AppID URI changes can enable identity-related access patterns that attackers may use for persistence or privilege escalation, making change monitoring important. Detection relies on Azure audit log message text captured in auditlogs telemetry.

Known false positives

When and administrator is making legitimate AppID URI configuration changes to an application. This should be a planned event.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.