Suspicious activity

Anomaly detection: Unusual event name diversity and increase in access denied responses made by service principal



Service principal can execute API calls. If a service principal started executing multiple API calls which result in access denied it may indicate a presence of an unauthorized actor in the cloud environment since this kind of activity is seen mostly when attackers conduct reconnaissance actions in order to map the internal environment and spread inside the environment. It was detected that the service principal {AzureServicePrincipal} has executed multiple API calls that resulted in access denied
  • Recommended Mitigation

    It is recommended to review relevant ActivityLog event that issued this API call to determine if this is a legit activity.