Skip to content
Threat Feed

Tag

Azure-Arc

2 briefs RSS
medium threat

Azure Service Principal Sign-In Followed by Arc Cluster Credential Access

Detects a service principal authenticating to Azure AD followed by listing credentials for an Azure Arc-connected Kubernetes cluster, indicating potential adversary activity with stolen service principal secrets to establish a proxy tunnel into Kubernetes clusters.

exploited azure azure-arc credential-access initial-access
2r 3t
medium advisory

Azure Service Principal Sign-In Followed by Arc Cluster Credential Access

Detects a service principal authenticating to Microsoft Entra ID and then listing credentials for an Azure Arc-connected Kubernetes cluster within a short time window, indicating potential unauthorized access to Kubernetes clusters via stolen service principal secrets.

azure azure-arc credential-access initial-access
2r 2t