Removal of an Azure Owner from an Application or Service Principal

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Azure Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Indicator Removal (T1070)
Severity	Informational

Description

An Azure Owner was removed from an application or service principal. This may indicate malicious activity or unauthorized access to the application or service.

Attacker's Goals

• Remove owners from applications for full control of the application or service principal.
• Manipulate or delete data stored in the Azure environment.

Investigative actions

• Check the Azure Activity Log to identify which user removed the Azure Owner.* Check the Azure Role Assignments to identify the current Azure Owners.* Check the Application or Service Principal to identify if any changes have been made.

Variations

Removal of an Azure AD privileged user from an Application or Service Principal

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Indicator Removal (T1070)
Severity	Low

Description

An Azure Owner was removed from an application or service principal. This may indicate malicious activity or unauthorized access to the application or service.

Attacker's Goals

• Remove owners from applications for full control of the application or service principal.
• Manipulate or delete data stored in the Azure environment.

Investigative actions

• Check the Azure Activity Log to identify which user removed the Azure Owner.* Check the Azure Role Assignments to identify the current Azure Owners.* Check the Application or Service Principal to identify if any changes have been made.