-
Azure Key Vault Excessive Secret or Key Retrieved
Sep 19, 2026 · Domain: Cloud Domain: Storage Domain: Identity Data Source: Azure Data Source: Azure Platform Logs Data Source: Azure Key Vault Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Credential Access Resources: Investigation Guide Noise: Low Performance: Fast Rule Type: ES|QL Platform: Azure Service: Azure Key Vault ·Identifies excessive secret or key retrieval operations from Azure Key Vault. This rule detects when a user principal retrieves secrets or keys from Azure Key Vault multiple times within a short time frame, which may indicate potential abuse or unauthorized access attempts. The rule focuses on high-frequency retrieval operations that deviate from normal user behavior, suggesting possible credential harvesting or misuse of sensitive information.
Read More -
Azure Key Vault Unusual Secret Key Usage
Sep 19, 2026 · Domain: Cloud Domain: Storage Domain: Identity Data Source: Azure Data Source: Azure Platform Logs Data Source: Azure Key Vault Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Credential Access Resources: Investigation Guide Noise: Medium Performance: Fast Rule Type: New Terms Platform: Azure Service: Azure Key Vault ·Identifies secrets, keys, or certificates retrieval operations from Azure Key Vault by a user principal that has not been seen previously doing so in a certain amount of days. Azure Key Vault is a cloud service for securely storing and accessing secrets, keys, and certificates. Unauthorized or excessive retrievals may indicate potential abuse or unauthorized access attempts.
Read More