Azure network security group was deleted from Tor IP address
Suspicious activity
Azure network security group was deleted from Tor IP address
Risk Level
Informational (4)
Platform(s)
Description
Orca detected that an API call to delete an Azure Network Security Group was made from Tor IP address, the operation was successful. This action may indicate of a presence of an unauthorized actor in the cloud environment, since the call was made from a malicious ip.
Recommended Mitigation
It is recommended to review the security group was deleted and the permissions that were used to make the call