Analytics BIOC
Informational
✕
Remote usage of an Azure Service Principal token
An Azure Service Principal token was used externally of the cloud environment.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Steal Application Access Token (T1528) Unsecured Credentials (T1552)
Attacker's goals:
Exfiltrate valid token and abuse it remotely.
Investigative actions:
Verify whether the service principal should be used remotely. Check what API calls were executed by the service principal. Determine whether the service principal is compromised.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
2 variations:
- Remote usage of an Azure Service Principal token from an unusual ASN High (parent: Informational)
- Remote usage of an Azure Service Principal token from an unusual IP Medium (parent: Informational)