Rules Contributing to Microsoft Entra Application Deleted Alert

The following rules are used to identify events when a Microsoft Entra application is deleted. Any one or more of these will trigger the Microsoft Entra Application Deleted Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Azure Application Deleted

Identifies when an application is deleted in Azure.

Rule ID

azure_80

Query

{'selection': {'properties_message': ['Delete application', 'Hard Delete application']}, 'condition': 'selection'}

Log Source

Stellar Cyber Microsoft Entra Events configured.

Rule Source

SigmaHQ,410d2a41-1e6d-452f-85e5-abdd8257a823

Author: Austin Songer @austinsonger

Tactics, Techniques, and Procedures

TA0040, T1489

References

Severity

50

Suppression Logic Based On

  • azure_ad.initiatedBy.user.id
  • azure_ad.initiatedBy.app.servicePrincipalId
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2021/09/03 medium

  • Application being deleted may be performed by a system administrator.

  • Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

  • Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.