Unusual Number of Azure Encryption Operations

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

This rule detects an unusual number of successful encryption-related operations performed by a single caller within a one-hour window in Azure Activity logs. This could indicate legitimate bulk administrative tasks or potentially malicious activity such as data encryption for impact (e.g., ransomware) or preparation for exfiltration by an attacker.