Azure Audit Logs: Application URI Configuration Changes (AppAddress)

Alerts on Azure audit log events indicating an application URI (AppAddress) was modified.

FreeReviewedSigma · High · v5

Product: azure
Service: auditlogs
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' (SigmaHQ), DRL 1.1
Published: 2022-06-02
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Cred Access

Recon
Resource Dev
Initial Access
- T1078.004Cloud Accounts
Execution
Persistence
- T1078.004Cloud Accounts
Priv Esc
- T1078.004Cloud Accounts
Defense Evasion
- T1078.004Cloud Accounts
Cred Access
- T1528Steal Application Access Token
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags events where an application’s AppAddress property is updated, indicating a change to an application URI configuration. Attackers may alter application URIs to redirect access flows, enable persistence, or capture credentials by pointing to attacker-controlled or improperly scoped domains. It relies on Azure audit log telemetry containing the specific message and property name associated with updating the AppAddress value.

Reporting behind it

Related detections9 linkedT1078.004 — drag to rearrange

Suspicious Microsoft Entra Device Code Authentication Flow

Suspicious Salesforce Connected App OAuth Authorization from VPN Egress

Suspicious OAuth Device Code Sign-In to Authentication Broker via Tycoon 2FA

Suspicious OAuth Application Registration with Localhost Reply URL via Azure AD

Malicious AWS Cross-Account AssumeRole With Suspicious Session Names via CloudTrail (via aws)

Suspicious Okta SSO Access to Many Applications in Short Window

Suspicious M365 Password Spraying via Azure PowerShell AppId from Quad7 Botnet

Suspicious AWS Instance Access or Export via SSH Key or Export Task

Suspicious Google Workspace OAuth Authorization for Chrome Web Store Scope via Token Audit

Azure Audit Logs: Application URI Configuration Changes (AppAddress)

Pivot detection · T1078.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-app-uri-updates-in-audit-logs-appaddress-property-changes-0055ad1f

title: "Azure Audit Logs: Application URI Configuration Changes (AppAddress)"
id: d67f55da-b432-4067-8002-e034c2a9a1b0
status: test
description: This rule flags events where an application’s AppAddress property is updated, indicating a change to an application URI configuration. Attackers may alter application URIs to redirect access flows, enable persistence, or capture credentials by pointing to attacker-controlled or improperly scoped domains. It relies on Azure audit log telemetry containing the specific message and property name associated with updating the AppAddress value.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-02
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1528
  - attack.t1078.004
  - attack.persistence
  - attack.credential-access
  - attack.privilege-escalation
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Update Application Sucess- Property Name AppAddress
  condition: selection
falsepositives:
  - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.
level: high
license: DRL-1.1
related:
  - id: 0055ad1f-be85-4798-83cf-a6da17c993b3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL