Azure Identity Pivoting Across Multiple Resource Types

Lacey Cochrane@NullVectorX

•updated Mar 9, 2026•2•0•54

Detects a single Azure identity accessing three or more distinct Azure resource types within a short time window. This behavior can indicate an attacker attempting to enumerate or pivot through an environment after compromising an identity.