Non-standard process reading SSH keys, cloud credentials and Microsoft tokens
Detects when a single non-standard process accesses multiple sensitive credential store categories (such as SSH keys, cloud provider credentials, and Microsoft OAuth tokens) on the same device within a short time window.
Microsoft Sentinel (KQL)
