Azure Application URI Configuration Modification

Attackers may modify application URIs within Azure Active Directory to redirect users or applications to malicious resources, obtain unauthorized access, or establish persistence. The modification of an application’s URI can be a subtle but effective technique for gaining a foothold in an environment. By manipulating the URI settings, attackers can redirect traffic to attacker-controlled servers, intercept credentials, or perform other malicious actions. This activity is often difficult to detect because it can blend in with legitimate administrative tasks. Investigation is merited if URIs for domain names no longer exist, are not using HTTPS, have wildcards at the end of the domain, are not unique to that app, or point to domains that the organization does not control.

Attack Chain

1. The attacker gains initial access to an Azure account with sufficient privileges to modify application registrations.
2. The attacker navigates to the Azure Active Directory portal.
3. The attacker locates a target application registration.
4. The attacker modifies the application’s URI settings, such as the reply URLs or identifier URIs.
5. The attacker configures the URI to point to a malicious server or a phishing page.
6. Users or applications are redirected to the malicious URI when attempting to authenticate or access the application.
7. The attacker intercepts credentials or performs other malicious actions.
8. The attacker establishes persistence by maintaining control over the application’s URI settings.

Impact

A successful attack could lead to credential theft, data breaches, or unauthorized access to sensitive resources. By compromising application URIs, attackers can redirect users to phishing pages, intercept credentials, or gain a foothold in the environment for further exploitation. This activity can be difficult to detect and can have a significant impact on the organization’s security posture.

Recommendation

• Deploy the Sigma rule Application URI Configuration Changes to your SIEM to detect suspicious modifications to application URIs in Azure Audit Logs.
• Investigate any alerts generated by the Sigma rule Application URI Configuration Changes to determine if the URI modification is legitimate or malicious.
• Monitor Azure Audit Logs for any changes to application URI settings (as indicated by properties.message: Update Application Sucess- Property Name AppAddress) and validate the legitimacy of the changes.