LoFP / when and administrator is making legitimate appid uri configuration changes to an application. this should be a planned event.

Techniques

• t1078
• t1078.004
• t1552

Sample rules

Application AppID Uri Configuration Changes

• source: sigma
• technicques:
  • t1078
  • t1078.004
  • t1552

Description

Detects when a configuration change is made to an applications AppID URI.

Detection logic

condition: selection
selection:
  properties.message:
  - Update Application
  - Update Service principal