Application URI Configuration Changes

Status: test
Severity: high
Log source: product azure, service auditlogs
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
Source: github.com/SigmaHQ/sigma

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Known false positives

When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts
Credential Access	`T1528` Steal Application Access Token

Telemetry coverage

Platform	Record / event type
Azure	any: Entra ID audit event (any operation)

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: Application URI Configuration Changes
id: 0055ad1f-be85-4798-83cf-a6da17c993b3
status: test
description: |
    Detects when a configuration change is made to an applications URI.
    URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022-06-02
tags:
    - attack.initial-access
    - attack.stealth
    - attack.t1528
    - attack.t1078.004
    - attack.persistence
    - attack.credential-access
    - attack.privilege-escalation
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message: Update Application Sucess- Property Name AppAddress
    condition: selection
falsepositives:
    - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    properties.message: Update Application Sucess- Property Name AppAddress

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`properties.message`	eq	`Update Application Sucess- Property Name AppAddress`	`field:"properties.message" kind:eq value:"Update Application Sucess- Property Name AppAddress"`