Analytics Informational
✕

An Azure identity performed multiple actions that were denied

An identity performed multiple Microsoft Graph actions that were denied, which may indicate it is being misused.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
Azure Audit Log, Microsoft Graph Logs
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Account Discovery (T1087) Permission Groups Discovery (T1069)
Detector tags: Microsoft Graph Activity Logs
Attacker's goals:

Execute various of commands to explore the cloud environment.

Investigative actions:

Check the identity's role designation in the organization. Check if there are additional calls executed by the identity.

Test period:
10 Minutes
Deduplication:
5 Days
3 variations:
  • An Azure application attempted multiple actions on resources that were denied Medium (parent: Informational)
  • An Azure identity attempted multiple actions on resources that were denied Low (parent: Informational)
  • An Azure application performed multiple actions that were denied Low (parent: Informational)