File creation of logAzure.txt containing Microsoft Graph credentials

Duo Tech@duotech

•updated Jul 21, 2026•0•0•3

Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.