Entra ID Application Restore
This rule detects when an application in Entra ID (formerly Azure AD) is restored. This action implies that the application was previously soft-deleted and is now being recovered. This could be an administrative action to recover a mistakenly deleted application or could indicate an attempt to restore a malicious application that was previously removed.
YARA-L
