Description

Orca detected that a virtual machine password reset was performed by the principal - {AzurePrincipal}, the operation was successful. This action may indicate of a presence of an unauthorized actor in the cloud environment. An attacker with an initial foothold, might try to change the password of virtual instances to ensure a persistent access to the cloud environment.