Azure DevOps
Named by 11 kept items in this workspace.
7 items name it under affected products and 4 under classification.technologies.
Search every workspace for Azure DevOps. It matches the name as written, so it can find other things that share it.
The items that name it 11
ADOAuditLogs
Development platform targeted by the threat actor; used to enumerate repositories, projects, pipelines, and deployment environments, and to create a malicious pipeline.
cloud service and on-premises Azure DevOps Server
Appears in more than 230 victim organizations in the CloudSEK dataset.
Platform hosting source repos, pull requests, pipelines, wikis, boards, and work items; PR descriptions support Markdown/HTML comments that render invisibly in the web UI but are returned verbatim via the API
All technologies in this workspace.