Azure App URI Updates in Audit Logs (AppAddress Property Changes)

title: Azure App URI Updates in Audit Logs (AppAddress Property Changes)
id: d67f55da-b432-4067-8002-e034c2a9a1b0
status: test
description: This rule flags audit log events where an application URI is updated, specifically when the AppAddress property is changed. Attackers can abuse application URI changes to redirect access paths, introduce attacker-controlled endpoints, or persist stealthy configuration modifications. It relies on Azure audit log telemetry containing a matching message string and the AppAddress property update within application configuration change events.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-02
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1528
  - attack.t1078.004
  - attack.persistence
  - attack.credential-access
  - attack.privilege-escalation
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Update Application Sucess- Property Name AppAddress
  condition: selection
falsepositives:
  - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.
level: high
license: DRL-1.1
related:
  - id: 0055ad1f-be85-4798-83cf-a6da17c993b3
    type: derived