Skip to content
Threat Feed
Subscribe

Tag

Azure-Arc

4 briefs RSS
medium threat

Azure Service Principal Sign-In Followed by Arc Cluster Credential Access

Detects a service principal authenticating to Azure AD followed by listing credentials for an Azure Arc-connected Kubernetes cluster, indicating potential adversary activity with stolen service principal secrets to establish a proxy tunnel into Kubernetes clusters.

exploited azure azure-arc credential-access initial-access
2r 3t
medium advisory

Azure Service Principal Sign-In Followed by Arc Cluster Credential Access

Detects a service principal authenticating to Microsoft Entra ID and then listing credentials for an Azure Arc-connected Kubernetes cluster within a short time window, indicating potential unauthorized access to Kubernetes clusters via stolen service principal secrets.

azure azure-arc credential-access initial-access
2r 2t
medium advisory

Kubernetes Secret or ConfigMap Access via Azure Arc Proxy

Detection of unauthorized access to Kubernetes secrets or configmaps via the Azure Arc AAD proxy service account, indicating potential abuse of stolen service principal credentials to read, exfiltrate, or modify sensitive data.

Azure Arc +2 kubernetes azure-arc credential-access collection
2r 2t
medium advisory

Unusual Source IP for Azure Arc Cluster Credential Access

Detects when a service principal or user performs an Azure Arc cluster credential listing operation from a source IP not previously associated with that identity, potentially indicating compromised credentials.

Azure Arc +1 azure azure-arc credential-access
2r 2t