Azure Application Service Principal URI Modification
This rule detects modifications to Azure Service Principal and Application object redirect URIs that match known patterns for reverse proxies, tunneling services, temporary callback infrastructure, or potential local token theft. Such changes may indicate an adversary attempting to establish persistent access, intercept authentication tokens, or bypass network controls via unauthorized application configurations.
Cortex XDR
