Description

Orca detected that a user was added to a group from a malicious IP address - {MaliciousIp.MaliciousIp}, the operation was successful. The operation was called from a malicious IP address - {MaliciousIp.MaliciousIp}, which might indicate of a privilege escalation attempt. An attacker with permissions to add users to groups, can add permissions to entities which are in his control.