Application URI Configuration Changes — Sigma Rule

Rule metadata and linked tags

Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'. Source status: test; severity: high. Source dates: 2022-06-02 / not supplied.

{
  "product": "azure",
  "service": "auditlogs"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 07d0ede34f24cf02b9b4bef2b3b93b6f1cbdc2ad9d94343b9a2322b31a449b6a

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Application URI Configuration Changes
id: 0055ad1f-be85-4798-83cf-a6da17c993b3
status: test
description: |
    Detects when a configuration change is made to an applications URI.
    URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022-06-02
tags:
    - attack.initial-access
    - attack.stealth
    - attack.t1528
    - attack.t1078.004
    - attack.persistence
    - attack.credential-access
    - attack.privilege-escalation
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message: Update Application Sucess- Property Name AppAddress
    condition: selection
falsepositives:
    - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.
level: high

Original YAML and metadata in JSON

False positives

• When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.

Source references

• https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes