Burst Retrieval of Azure Key Vault Secrets
Detects a single identity rapidly reading a large number of distinct secrets from an Azure Key Vault within a short timeframe (10 minutes). This behavior is indicative of automated secret harvesting, potentially by an attacker who has compromised an identity with access to the Key Vault. The rule specifically looks for at least 25 reads and 10 distinct secrets accessed by the same identity and IP address within the time window.
Microsoft Sentinel (KQL)
