Analytics BIOC Informational

Azure permission delegation granted

An identity delegated permissions to access a certain resource or application.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
Azure Audit Log
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Account Manipulation (T1098)
Attacker's goals:

Gain access to sensitive data.* Gain control over user accounts.

Investigative actions:

Check the user access logs for any suspicious activity.* Review the permissions granted and the scope of the permissions.

Test period:
N/A (single event)
Deduplication:
5 Days
1 variation:
  • Azure permission delegation granted by an Azure AD privileged user Low (parent: Informational)