Azure enumeration activity using Microsoft Graph API

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: Azure Audit Log OR Microsoft Graph Logs
Detection Modules	Cloud
Detector Tags	Microsoft Graph Activity Logs
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Informational

Description

The Microsoft Graph API was used to enumerate an Azure tenant.

Attacker's Goals

Map the Azure tenant and detect potential resources to abuse.

Investigative actions

• Check the identity's role designation in the organization.
• Identify which available resources were discovered.
• Investigate if the discovered resources were used to extract sensitive information or perform other attacks in the cloud environment.

Variations

Azure sensitive resources enumeration activity using Microsoft Graph API

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Informational

Description

Microsoft Graph API was used to enumerate sensitive resources in Azure tenant.

Attacker's Goals

Map the Azure tenant and detect potential resources to abuse.

Investigative actions

• Check the identity's role designation in the organization.
• Identify which available resources were discovered.
• Investigate if the discovered resources were used to extract sensitive information or perform other attacks in the cloud environment.