Analytics BIOC
Low
✕
Privileged role used by Azure application
An Azure application with high-level API permissions invoked a request to the Microsoft Graph API.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log, Microsoft Graph Logs
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Account Manipulation: Additional Cloud Roles (T1098.003)
Detector tags: Microsoft Graph Activity Logs
Attacker's goals:
Leverage high-level permissions to gain persistence and access to sensitive information.
Investigative actions:
Check the application's role designation in the organization. Look for any unusual behavior originated from the suspected application.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day