Azure Application Deleted

calendar Jul 3, 2026 · attack.impact attack.t1489  ·
Share on: linkedin copy

Identifies when a application is deleted in Azure.

Sigma rule (View on GitHub)

 1title: Azure Application Deleted
 2id: 410d2a41-1e6d-452f-85e5-abdd8257a823
 3status: test
 4description: Identifies when a application is deleted in Azure.
 5references:
 6    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy
 7    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
 8    - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415
 9author: Austin Songer @austinsonger
10date: 2021-09-03
11modified: 2026-04-30
12tags:
13    - attack.impact
14    - attack.t1489
15logsource:
16    product: azure
17    service: auditlogs
18detection:
19    selection:
20        operationName:
21            - 'Delete application'
22            - 'Hard Delete application'
23            - 'Delete administrative unit'
24    condition: selection
25falsepositives:
26    - Application being deleted may be performed by a system administrator.
27    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
28    - Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
29level: medium

References

Related rules

to-top