Users Opening and Reading the Local Device Identity Key

'This detection uses Windows security events to look for users reading the local Device Identity Key (Machine Key). This information can be correlated with other events for additional context and get to use-cases where a machine key with a transport key together can be used to impersonate an Entra ID joined or registered machine. Reference: https://o365blog.com/post/deviceidentity/'