Bulk secret reads or KMS decrypts by a principal from multiple IPs
Detects a high volume of Azure Key Vault secret reads or key decryption operations performed by a single caller identity from multiple source IP addresses within a one-hour window, which may indicate credential harvesting or unauthorized access.
Microsoft Sentinel (KQL)
