LoFP / application being deleted may be performed by a system administrator.

Techniques

• t1489

Sample rules

Azure Application Deleted

• source: sigma
• technicques:
  • t1489

Description

Identifies when a application is deleted in Azure.

Detection logic

condition: selection
selection:
  operationName:
  - Delete application
  - Hard Delete application
  - Delete administrative unit