A Service Principal was removed from Azure

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Azure Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Modify Cloud Compute Infrastructure: Delete Cloud Instance (T1578.003)
Severity	Informational

Description

A service principal was removed from Azure. This indicates a change in access permissions and may indicate malicious activity.

Attacker's Goals

• Evade defensive measures by deleting a possibly malicious service principal.

Investigative actions

• Check the Azure Active Directory audit logs for the details of the removed service principal.* Check the Azure role assignments to identify which resources were impacted by the removal of the service principal.