Analytics
Medium
✕
Suspicious Azure enumeration activity
An Azure identity performed resource enumeration across multiple services using Microsoft Graph.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log, Microsoft Graph Logs
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Cloud Service Discovery (T1526)
Detector tags: Microsoft Graph Activity Logs
Attacker's goals:
Map the Azure tenant and detect potential resources to abuse.
Investigative actions:
Check the identity's role designation in the organization. Identify which resources were discovered. Investigate if the discovered resources were used to extract sensitive information or perform other attacks in the cloud environment.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day