Entra ID Conditional Access Policy Modification
This rule detects when an Entra ID (formerly Azure Active Directory) conditional access policy has been modified. It specifically looks for 'USER_RESOURCE_UPDATE_CONTENT' events within Office 365, targeting the 'AzureActiveDirectory' application, where the 'extendedAuditEventCategory' is 'Policy' and the 'product_event_type' is 'Update policy.'. This indicates a change to a conditional access policy, which could be a legitimate administrative action or a malicious attempt to alter security controls.
YARA-L
