Azure Privilege Anomaly: Root Scope

Triggers

• Unusual use of a highly permissive role observed within a Root Scope.

Possible Root Causes

• Unauthorized Access: An attacker is leveraging elevated permissions to gain additional or persistent access to the environment.
• Administrative Use: An administrator is using a highly permissive role to facilitate complete access to the environment.

Business Impact

• Lateral movement may indicate that an adversary has established a foothold in the environment and is progressing towards their objective, increasing the risk of material impact.

Steps to Verify

• Investigate the Principal: Review the identity that performed the actions for other signs of malicious activity.
• Review Privileges: Assess whether this account should have the assigned level of privilege based on their normal duties.
• If Malicious Actions or High-Risk Configurations Are Suspected:
  • Revert any unauthorized configuration changes.
  • Disable credentials associated with the alert to prevent further misuse.
  • Conduct a comprehensive investigation to determine the initial compromise and scope of impacted resources.