Azure Audit Logs: Application URI Configuration Changes (AppAddress)
Alerts on Azure audit log events indicating an application URI (AppAddress) was modified.
- Product
- azure
- Service
- auditlogs
- Author
- Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' (SigmaHQ), DRL 1.1
- Published
- 2022-06-02
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags events where an application’s AppAddress property is updated, indicating a change to an application URI configuration. Attackers may alter application URIs to redirect access flows, enable persistence, or capture credentials by pointing to attacker-controlled or improperly scoped domains. It relies on Azure audit log telemetry containing the specific message and property name associated with updating the AppAddress value.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Audit Logs: Application URI Configuration Changes (AppAddress)"
id: d67f55da-b432-4067-8002-e034c2a9a1b0
status: test
description: This rule flags events where an application’s AppAddress property is updated, indicating a change to an application URI configuration. Attackers may alter application URIs to redirect access flows, enable persistence, or capture credentials by pointing to attacker-controlled or improperly scoped domains. It relies on Azure audit log telemetry containing the specific message and property name associated with updating the AppAddress value.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-02
tags:
- attack.initial-access
- attack.stealth
- attack.t1528
- attack.t1078.004
- attack.persistence
- attack.credential-access
- attack.privilege-escalation
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message: Update Application Sucess- Property Name AppAddress
condition: selection
falsepositives:
- When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.
level: high
license: DRL-1.1
related:
- id: 0055ad1f-be85-4798-83cf-a6da17c993b3
type: derived