Key Eater IOC sweep: operator IPs, tunnel IP and actor user agents
Performs a retrospective threat hunt for Key Eater indicators of compromise, checking Entra ID sign-ins, Azure DevOps auditing logs, and network events for known malicious IPs, subnets, user agents, and tunnel infrastructure.
Microsoft Sentinel (KQL)
