Multiple Azure Storage Account Key Retrievals

Ankit Mehta@Secvyn

•updated Jun 16, 2026•0•0•2

This rule detects when a single caller performs multiple (3 or more) retrievals of Azure Storage Account Keys within a one-hour window. This activity can indicate an attempt to gain unauthorized access to storage resources or exfiltrate data.