LoFP / application deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

Techniques

• t1489

Sample rules

Azure Application Deleted

• source: sigma
• technicques:
  • t1489

Description

Identifies when a application is deleted in Azure.

Detection logic

condition: selection
selection:
  operationName:
  - Delete application
  - Hard Delete application
  - Delete administrative unit