Suspicious activity

Anomaly detection: Unusual user access from cli

Platform(s)

Description

User can execute API through console/CLI. If a user started executing multiple API calls from CLI unlike before it may indicate a presence of an unauthorized actor in the cloud environment since this kind of activity is seen mostly when attackers conduct reconnaissance actions in order to map the internal environment and spread inside the environment. It was detected that user {AzureUser} executed increasing number of APIs from CLI unlike before.
Need help?

Get a free Security Risk Assessment. Start today

Orca Security Demo Demo the Orca Platform-> In just 10 minutes, you’ll see how Orca Security can revolutionize your cloud security strategy. Watch a recorded demo from a cloud security expert now.