Azure Key Vault Secret Accessed via API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to access secrets stored in Azure Key Vault via its API. It specifically looks for HTTP traffic where the host matches the Azure Key Vault domain pattern '*.vault.azure.net' and the URI contains '/secrets/'. This indicates a potential attempt to retrieve sensitive information.