Elastic low stable kql

Entra ID User Added as Registered Application Owner

Identifies when a user is added as an owner for an Azure application. An adversary may add a user account as an owner for an Azure application in order to grant additional permissions and modify the application's configuration using another account.

View Source

Detection Logic

data_stream.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add owner to application" and event.outcome:(Success or success)

Field Validations

Loading…

Comments (0)

Loading comments...