Unusual resource access by Azure application

Cortex XDR Analytics Alert Reference by data source

Product: Cortex XDR
Last date published: 2024-12-03
Category: Analytics Alert Reference
Index by: data source

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: Azure Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Informational

Description

An Azure application had interacted with an unusual resource using the Microsoft Graph API.

Attacker's Goals

Abuse applications to gain access to the Azure tenant.

Investigative actions

Verify whether the application is intended to use the resource in question.
Investigate any unusual activity originating from the application.

Variations

Suspicious resource access by Azure application

Synopsis

ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Low

Description

An Azure application had interacted with an unusual resource using the Microsoft Graph API.

Attacker's Goals

Abuse applications to gain access to the Azure tenant.

Investigative actions

Verify whether the application is intended to use the resource in question.
Investigate any unusual activity originating from the application.