-
Azure Key Vault Excessive Secret or Key Retrieved
Sep 19, 2026 · Domain: Cloud Domain: Storage Domain: Identity Data Source: Azure Data Source: Azure Platform Logs Data Source: Azure Key Vault Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Credential Access Resources: Investigation Guide Noise: Low Performance: Fast Rule Type: ES|QL Platform: Azure Service: Azure Key Vault ·Identifies excessive secret or key retrieval operations from Azure Key Vault. This rule detects when a user principal retrieves secrets or keys from Azure Key Vault multiple times within a short time frame, which may indicate potential abuse or unauthorized access attempts. The rule focuses on high-frequency retrieval operations that deviate from normal user behavior, suggesting possible credential harvesting or misuse of sensitive information.
Read More -
Identifies modifications to a Key Vault in Azure. The Key Vault is a service that safeguards encryption keys and secrets like certificates, connection strings, and passwords. Because this data is sensitive and business critical, access to key vaults should be secured to allow only authorized applications and users. This is a New Terms rule that detects when this activity hasn't been seen by the user in a specified time frame.
Read More -
Azure Key Vault Unusual Secret Key Usage
Sep 19, 2026 · Domain: Cloud Domain: Storage Domain: Identity Data Source: Azure Data Source: Azure Platform Logs Data Source: Azure Key Vault Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Credential Access Resources: Investigation Guide Noise: Medium Performance: Fast Rule Type: New Terms Platform: Azure Service: Azure Key Vault ·Identifies secrets, keys, or certificates retrieval operations from Azure Key Vault by a user principal that has not been seen previously doing so in a certain amount of days. Azure Key Vault is a cloud service for securely storing and accessing secrets, keys, and certificates. Unauthorized or excessive retrievals may indicate potential abuse or unauthorized access attempts.
Read More -
Multiple Cloud Secrets Accessed by Source Address
Sep 19, 2026 · Domain: Cloud Domain: IAM Domain: Storage Data Source: AWS Data Source: Amazon Web Services Data Source: AWS Secrets Manager Data Source: Azure Data Source: Azure Activity Logs Data Source: GCP Data Source: Google Cloud Platform Data Source: Kubernetes Tactic: Credential Access Resources: Investigation Guide Noise: Low Performance: Fast Profile: Recommended Rule Type: ES|QL Platform: AWS Platform: Azure Platform: Kubernetes Platform: GCP Domain: Containers Domain: Identity Service: AWS Secrets Manager Data Source: Azure Platform Logs Service: Azure Key Vault Service: GCP Secret Manager ·This rule detects authenticated sessions accessing secret stores across multiple environments from the same source address within a short period of time, including cloud providers (AWS, GCP, Azure) and Kubernetes clusters. Adversaries with access to compromised credentials or session tokens may attempt to retrieve secrets from services such as AWS Secrets Manager, Google Secret Manager, Azure Key Vault, or Kubernetes Secrets in rapid succession to expand their access or exfiltrate sensitive information.
Read More