Suspicious Azure enumeration activity

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-03-17

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires:
Detection Modules	Cloud
Detector Tags	Microsoft Graph Activity Logs
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Medium

An Azure identity performed resource enumeration across multiple services using Microsoft Graph.

Map the Azure tenant and detect potential resources to abuse.

Check the identity's role designation in the organization.
Identify which resources were discovered.
Investigate if the discovered resources were used to extract sensitive information or perform other attacks in the cloud environment.