EF CON 34 – Dolev Taler, Mark Vaitsman – Data Tomb Raider — legacy-flaw access pattern against AI/secret vaults

Ankit Mehta@Secvyn

•updated Aug 13, 2026•5•0•4

This rule monitors Azure Key Vault operations, specifically focusing on unauthorized or excessive retrieval of secrets, keys, or certificates. It triggers when a specific user or service principal makes 10 or more requests for unique assets within a 10-minute window, which may indicate automated discovery, mass exfiltration, or a brute-force attempt to harvest credentials stored within the vault.