Azure AD Conditional Access Policy Deleted by Non-Approved Actor

Flags Azure audit log events where a conditional access policy is deleted.

FreeUnreviewedSigmamediumv1

azure-ad-conditional-access-policy-deleted-by-non-approved-actor-26e7c5e2

title: Azure AD Conditional Access Policy Deleted by Non-Approved Actor
id: b3599b3e-a198-4aeb-aedd-cd16e347df18
status: test
description: This rule alerts when an audit event indicates a conditional access policy was deleted. Deleting conditional access policies can disrupt security controls and enable attacker persistence or defense evasion. It relies on Azure audit log telemetry where the event message explicitly matches the conditional access policy deletion action.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml
author: Corissa Koopmans, '@corissalea', Huntrule Team
date: 2022-07-19
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.persistence
  - attack.defense-impairment
  - attack.t1548
  - attack.t1556
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Delete conditional access policy
  condition: selection
falsepositives:
  - Misconfigured role permissions
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
level: medium
license: DRL-1.1
related:
  - id: 26e7c5e2-6545-481e-b7e6-050143459635
    type: derived

What it detects

This rule alerts when an audit event indicates a conditional access policy was deleted. Deleting conditional access policies can disrupt security controls and enable attacker persistence or defense evasion. It relies on Azure audit log telemetry where the event message explicitly matches the conditional access policy deletion action.

Known false positives

Misconfigured role permissions
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.