Azure Owner Removed From Application or Service Principal

Description

Identifies when a owner is was removed from a application or service principal in Azure.

Query · sigma

selection:
  operationName:
  - Remove owner from service principal
  - Remove owner from application
condition: selection

Known false positives

  • Owner being removed may be performed by a system administrator.
  • Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  • Owner removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
Raw source Azure Owner Removed From Application or Service Principal · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Azure Owner Removed From Application or Service Principal
id: 636e30d5-3736-42ea-96b1-e6e2f8429fd6
status: test
description: Identifies when a owner is was removed from a application or service principal in Azure.
references:
    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
author: Austin Songer @austinsonger
date: 2021-09-03
modified: 2026-04-30
tags:
    - attack.stealth
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        operationName:
            - 'Remove owner from service principal'
            - 'Remove owner from application'
    condition: selection
falsepositives:
    - Owner being removed may be performed by a system administrator.
    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - Owner removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.