LoFP / when a new application owner is added by an administrator

Techniques

• t1552

Sample rules

Added Owner To Application

• source: sigma
• technicques:
  • t1552

Description

Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

Detection logic

condition: selection
selection:
  properties.message: Add owner to application