Most Popular Detection 2026 – AI Agent Tool Credential Harvesting (MITRE ATLAS)
Detects anomalous access to SharePoint or OneDrive by identities identified as bots, agents, or service principals. The rule specifically monitors for multiple file accesses where the file names suggest the presence of secrets, passwords, or API keys, which may indicate a compromised or malicious AI agent attempting to harvest credentials.
Microsoft Sentinel (KQL)
