Title:Added Owner To Application Status:test Description:Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application. References: -https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' Date: 2022-06-02 modified:None Tags:
-'attack.t1552'
-'attack.credential-access'
Logsource:
product: azure
service: auditlogs
Detection: selection: properties.message:
'Add owner to application' condition:selection Falsepositives:
-When a new application owner is added by an administrator Level:medium
