Owner was added to Azure application

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: Azure Audit Log OR Microsoft Graph Logs
Detection Modules	Cloud
Detector Tags	Microsoft Graph Activity Logs
ATT&CK Tactic	Privilege Escalation (TA0004), Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098), Valid Accounts (T1078)
Severity	Informational

Description

An Owner was added to an Azure application.

Attacker's Goals

Gain administrative control and manipulate the application's permissions and settings.

Investigative actions

• Look for any unusual behavior originated from the suspected identity, and check if they're compromised.