Azure Audit Logs: Application AppID URI Updates via App or Service Principal Changes

title: "Azure Audit Logs: Application AppID URI Updates via App or Service Principal Changes"
id: d44cb102-d13e-4f3f-9143-e7a3ae77e378
status: test
description: This rule identifies events where an application or service principal is updated, specifically when the AppID URI configuration is changed. Attackers may alter AppID URI values to redirect authentication flows or maintain persistence by changing how identities are recognized. Detection relies on Azure audit log entries that contain the update message indicating an application or service principal was updated.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-02
tags:
  - attack.initial-access
  - attack.persistence
  - attack.credential-access
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1552
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
      - Update Application
      - Update Service principal
  condition: selection
falsepositives:
  - When and administrator is making legitimate AppID URI configuration changes to an application. This should be a planned event.
level: high
license: DRL-1.1
related:
  - id: 1b45b0d1-773f-4f23-aedc-814b759563b1
    type: derived