Azure Storage Account CMK Modification
Detects the modification of an Azure Storage account's encryption settings to use a Key Vault for Customer-Managed Keys (CMK). This activity can be indicative of ransomware attacks where adversaries switch to an attacker-controlled key and then delete it, rendering all data in the storage account inaccessible.
Microsoft Sentinel (KQL)
