Sigma rule: Azure Application Deleted

Rule

Title

Azure Application Deleted

Status

test

Level

medium

Author

Austin Songer @austinsonger

Date

2021-09-03

Modified

2026-04-30

File

rules/cloud/azure/audit_logs/azure_application_deleted.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies when a application is deleted in Azure.

Log source

product

azure

service

auditlogs

Detection

selection:
    operationName:
        - 'Delete application'
        - 'Hard Delete application'
        - 'Delete administrative unit'
condition: selection

False positives (as the rule lists them)

• Application being deleted may be performed by a system administrator.
• Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
• Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.impact
• attack.t1489

MITRE ATT&CK ids this rule names

• T1489

References

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy
• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
• https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/audit_logs/azure_application_deleted.yml