Analytics BIOC Informational
✕

Attempted Azure application access from unknown tenant

A Microsoft Graph API was unsuccessfully executed by an Azure application from an unknown tenant.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
Azure Audit Log, Microsoft Graph Logs
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Trusted Relationship (T1199)
Detector tags: Microsoft Graph Activity Logs
Attacker's goals:

Abuse serverless services to execute code in cloud environments.

Investigative actions:

Validate the legitimacy of the tenant in question. Investigate any unusual activity originating from the application.

Test period:
N/A (single event)
Deduplication:
5 Days
2 variations:
  • Attempted Azure application access from an unusual tenant Medium (parent: Informational)
  • Azure application access from unknown tenant Low (parent: Informational)