A detailed incident analysis from Sysdig's Threat Research Team documenting how an attacker used a single leaked Azure service principal credential to achieve full tenant takeover in under an hour. The attack traversed five separate Azure permission systems: Entra directory roles, Azure RBAC, Key Vault access policies, bearer keys/SAS tokens, and Graph API application permissions. Key moves included self-granting Global Administrator via a pre-consented RoleManagement.ReadWrite.Directory Graph permission, using elevateAccess to bridge directory and resource control planes, harvesting storage and Event Hub keys (including the tenant's own telemetry pipeline), and planting backdoor credentials on 26 app registrations. The post explains why each permission plane is invisible from the others, why bearer keys create permanent blind spots, and provides concrete defensive recommendations: inventory all five planes, treat NHIs as first-class identities, alert on cross-plane bridge operations like elevateAccess and listKeys, disable shared keys where possible, and enable logging that is off by default. Sysdig's Falco-based detection rules that correlate across both the Entra audit log and Azure Activity log are highlighted as the mechanism that made the full attack chain reconstructable.
