Azure Service Principal Removed

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•33

Identifies when a service principal was removed in Azure. This action could indicate an attempt to remove legitimate service accounts to hinder detection or to clean up after malicious activity.