Microsoft cloud activity from AzureHound default user agent
Description
AlphaSOC detected Microsoft Entra ID or Microsoft 365 activity with a user agent
containing azurehound. AzureHound collects Entra ID and Azure relationship
data for BloodHound, including users, groups, roles, and resources. Defenders
and security testers use it to identify attack paths, but attackers may also use
it to plan privilege escalation and lateral movement.
The detection identifies the tool by its default user agent, which can be changed. Habitual activity from the same identity may be suppressed, while activity from an unexpected source ASN still triggers an alert.
Impact
Unauthorized AzureHound activity may expose relationships between identities, permissions, and cloud resources. An attacker can use this information to identify valuable targets and paths to additional access. This activity may indicate reconnaissance; it does not by itself confirm that an attack path was exploited.
Severity
| Severity | Condition |
|---|---|
Medium | Activity with the AzureHound default user agent |
High | AzureHound activity from an unexpected source ASN |
Investigation and Remediation
Review the associated Entra or Microsoft 365 logs to identify the acting identity, source IP, ASN, user agent, and operations performed. Confirm whether the collection was part of an authorized security assessment. Review related directory and resource enumeration, sign-ins, and subsequent role assignments or access to sensitive resources.
If unauthorized, revoke affected sessions and tokens and reset compromised credentials. Investigate the identity's activity for follow-on attacks and remove any unauthorized permissions or persistence mechanisms.
Known False Positives
- Authorized BloodHound assessments or red-team exercises using AzureHound