LoFP / application security group being modified or deleted may be performed by a system administrator.

Techniques

Sample rules

Azure Application Security Group Modified or Deleted

• source: sigma
• technicques:

Description

Identifies when a application security group is modified or deleted.

Detection logic

condition: selection
selection:
  operationName:
  - MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/WRITE
  - MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/DELETE