Azure Audit Logs: Application URI Configuration Changes (AppAddress)

Alerts on Azure audit log events indicating an application URI (AppAddress) was modified.

FreeReviewedSigma · High · v5

Product: azure
Service: auditlogs
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' (SigmaHQ), DRL 1.1
Published: 2022-06-02
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Cred Access

Recon
Resource Dev
Initial Access
- T1078.004Cloud Accounts
Execution
Persistence
- T1078.004Cloud Accounts
Priv Esc
- T1078.004Cloud Accounts
Defense Evasion
- T1078.004Cloud Accounts
Cred Access
- T1528Steal Application Access Token
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags events where an application’s AppAddress property is updated, indicating a change to an application URI configuration. Attackers may alter application URIs to redirect access flows, enable persistence, or capture credentials by pointing to attacker-controlled or improperly scoped domains. It relies on Azure audit log telemetry containing the specific message and property name associated with updating the AppAddress value.

Reporting behind it

Related detections9 linkedT1078.004 — drag to rearrange

Suspicious OAuth Application Registration with Localhost Reply URL via Azure AD

Suspicious Google Cloud Function Create or Update Triggering Build

Malicious OAuth Application Granted Full Mailbox and EWS Permissions (via m365)

Possible Credential Stuffing Blocked by Conditional Access in Microsoft 365

Suspicious GAM OAuth Token Enumeration via Process Creation

Suspicious SES Account Sending Enablement and Identity Verification via CloudTrail

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

Suspicious AWS Federated Console Login From Programmatic Credentials

Suspicious Entra ID Device Code Flow Authentication

Azure Audit Logs: Application URI Configuration Changes (AppAddress)

Pivot detection · T1078.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-app-uri-updates-in-audit-logs-appaddress-property-changes-0055ad1f

title: "Azure Audit Logs: Application URI Configuration Changes (AppAddress)"
id: d67f55da-b432-4067-8002-e034c2a9a1b0
status: test
description: This rule flags events where an application’s AppAddress property is updated, indicating a change to an application URI configuration. Attackers may alter application URIs to redirect access flows, enable persistence, or capture credentials by pointing to attacker-controlled or improperly scoped domains. It relies on Azure audit log telemetry containing the specific message and property name associated with updating the AppAddress value.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-02
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1528
  - attack.t1078.004
  - attack.persistence
  - attack.credential-access
  - attack.privilege-escalation
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Update Application Sucess- Property Name AppAddress
  condition: selection
falsepositives:
  - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.
level: high
license: DRL-1.1
related:
  - id: 0055ad1f-be85-4798-83cf-a6da17c993b3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL