Suspicious activity

Anomaly detection: service principal tried accessing resources that don’t exist

Platform(s)

Description

Service principal tries to call API for resources that don't exist. If a service principal started executing multiple API calls that return not found error unlike before it may indicate a presence of an unauthorized actor in the cloud environment since this kind of activity is seen mostly when attackers conduct reconnaissance actions in order to map the internal environment and spread inside the environment. It was detected that service principal {AzureServicePrincipal} got more not found errors than before, which might be suspicious.
  • Recommended Mitigation

    It is recommended to review relevant ActivityLog event that issued this API call to determine if this is a legit activity.