Analytics BIOC
Low
✕
Remote usage of an Azure Managed Identity token
An Azure Managed Identity token, which is attached to a compute service, was used externally of the cloud environment.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Steal Application Access Token (T1528) Unsecured Credentials (T1552)
Detector tags: Cloud Serverless Function Credentials Theft Analytics
Attacker's goals:
Exfiltrate valid token and abuse it remotely.
Investigative actions:
Verify whether the Managed Identity should be used remotely. Check what API calls were executed by the Managed Identity. Check if the relevant compute service is compromised.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
4 variations:
- Remote usage of an Azure Function App's Managed Identity token Medium (parent: Low)
- Remote usage of an Azure Automation Account's Managed Identity token Medium (parent: Low)
- Remote usage of an Azure Managed Identity token from an unusual ASN High (parent: Low)
- Remote usage of an Azure Managed Identity token from an unusual IP Medium (parent: Low)