Azure Function or Logic App Invocation Spike - Cloud Service Hijacking

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•2

Detects instances where a specific identity or caller triggers Azure Function or Logic App workflows at a high volume (more than 50 successful invocations within a 5-minute window). This threshold may indicate automated exploitation, potential brute-force attempts on API endpoints, or a misconfigured/malfunctioning service causing excessive resource usage.