Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
Products / Services
10,680
9,761
6,694
4,418
3,744
MITRE Techniques
1
1
Detects one identity reading secrets from several Azure Key Vaults in a day beyond its own 14 day baseline, which matches the bulk secret reads Microsoft reported after the ConnectWise application compromise. It needs the CloudKeyVaultEvents table, does not flag an identity that already reads many vaults every day and cannot show whether the reads were legitimate. The query ran without errors in a live tenant.
