Rapid Create-Use-Revoke Cycling of Developer Keys/Service JWTs

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•1

Detects high-frequency creation and revocation of service principal credentials, indicating potential malicious credential cycling, or unusual bursts of service account JWT/refresh token rotation across multiple IP addresses, which may indicate an attempt to evade detection or maintain persistence.