Bulk Credential Dump Across K8s, Backup Vaults, and Key Vaults

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•3

This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.