Auditlogs Applicationuriadded

KQL detection rule by ep3p · MIT

No description provided

AuditLogs
| where Category == "ApplicationManagement" and AADOperationType == "Update" //and OperationName == "Update Application" and Result == "success"
| mv-expand modifiedProperty = TargetResources[0]["modifiedProperties"]
| extend ModifiedProperty = tostring(modifiedProperty["displayName"])
| where ModifiedProperty in ("AppIdentifierUri", "AppAddress")
| extend
    NewAddresses = iff(ModifiedProperty == "AppIdentifierUri", todynamic(tostring(modifiedProperty["newValue"])), extract_all(@'\"Address\"\:\"([^"]+)\"', tostring(modifiedProperty["newValue"]))),
    OldAddresses = iff(ModifiedProperty == "AppIdentifierUri", todynamic(tostring(modifiedProperty["oldValue"])), extract_all(@'\"Address\"\:\"([^"]+)\"', tostring(modifiedProperty["oldValue"])))
| where isnotempty(NewAddresses)
| extend AddedAddresses = set_difference(NewAddresses, OldAddresses)
| where array_length(AddedAddresses) > 0
| extend AppDisplayName = tostring(TargetResources[0]["displayName"])
| summarize
    TimeGenerated = min(TimeGenerated),
    AddedAddresses = array_sort_asc(make_set(AddedAddresses)),
    NewAddresses = array_sort_asc(make_set(NewAddresses)),
    OldAddresses = array_sort_asc(make_set(OldAddresses)),
    OperationNames = array_sort_asc(make_set(OperationName)),
    TargetResources = make_bag(bag_pack(Id, TargetResources)),
    OperationIds = make_list(Id),
    take_any(*)
    by CorrelationId, AppDisplayName, Result
| extend
    Initiator = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["displayName"]), tostring(InitiatedBy["user"]["userPrincipalName"])),
    InitiatorId = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["servicePrincipalId"]), tostring(InitiatedBy["user"]["id"])),
    IPAddress = tostring(InitiatedBy[tostring(bag_keys(InitiatedBy)[0])]["ipAddress"])
| mv-expand AddedAddress = AddedAddresses to typeof(string)
| project
    TimeGenerated,
    LoggedByService,
    Category,
    AADOperationType,
    Initiator = coalesce(Initiator, Identity),
    IPAddress,
    OperationNames,
    Result,
    AppDisplayName,
    AddedAddress,
    AddedAddresses,
    OldAddresses,
    NewAddresses,
    AdditionalDetails,
    InitiatedBy,
    InitiatorId,
    TargetResources,
    OperationIds,
    CorrelationId

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

37f671da-f685-4fa4-80af-14e24ff5d176

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion