2026 Critical Cloud Identity Detection: New Application Secret Immediately Used from a First-Seen IP Address
Detects the creation of a new application secret or credential in a cloud environment followed by an immediate authentication attempt using that credential from an IP address that has not been observed performing successful authentication within the specified lookback window. This behavior is indicative of potential unauthorized persistence or the use of compromised credentials by an adversary.
Microsoft Sentinel (KQL)
