Malicious service provider activity detection

A method of comprising:

• obtaining a plurality of logs, the obtained logs comprising respective records of respective control plane operations executed on behalf of a first entity;
• identifying logs of the plurality of logs that comprise records of control plane operations executed by a respective cloud application associated with the first entity;
• generating a filtered set of logs by removing the identified logs from the plurality of logs, the filtered set of logs comprising a first log comprising a record of a first control plane operation executed on behalf of a first entity;
• identifying a service provider associated with the execution of the first control plane operation, the service provider having privileges to execute control plane operations on behalf of the first entity;
• determining, based at least on the service provider, a first malicious activity score indicative of a degree to which the first control plane operation is anomalous with respect to the first entity;
• determining, based at least on the determined first malicious activity score, the first control plane operation potentially corresponds to malicious activity;
• and
• responsive to determining that the first control plane operation potentially corresponds to malicious activity, generating a security alert.

A system, comprising:

• a processor circuit;
• and
• a memory that stores program code that is executable by the processor circuit to perform operations, the operations comprising:
• obtaining a first log that comprises a record of a first control plane operation executed on behalf of a first entity;
• identifying a service provider associated with the execution of the first control plane operation, the service provider having privileges to execute control plane operations on behalf of the first entity;
• determining, based at least on the service provider, a first malicious activity score indicative of a degree to which the first control plane operation is anomalous with respect to the first entity;
• determining a second malicious activity score indicative of a degree to which a second control plane operation is anomalous with respect to a second entity, the second control plane operation executed by a cloud application associated with the service provider and on behalf of the second entity;
• determining, based at least on the first malicious activity score and the second malicious activity score, the first control plane operation potentially corresponds to malicious activity;
• and
• responsive to determining that the first control plane operation potentially corresponds to malicious activity, generating a security alert.

A computer-readable storage medium encoded with program instructions that, when executed by one or more processors, performs a method, the method comprising:

• obtaining a first log that comprises a record of a first control plane operation executed on behalf of a first entity;
• identifying a service provider associated with the execution of the first control plane operation, the service provider having privileges to execute control plane operations on behalf of the first entity;
• obtaining data indicative of a second control plane operation executed by a first cloud application associated with the service provider and on behalf of the first entity, the second control plane operation executed prior to the first control plane operation;
• determining, based at least on the service provider and the obtained data, a first malicious activity score indicative of a degree to which the first control plane operation is anomalous with respect to the first entity;
• determining, based at least on the determined first malicious activity score, the first control plane operation potentially corresponds to malicious activity;
• and
• responsive to determining that the first control plane operation potentially corresponds to malicious activity, generating a security alert.