Storm-3168 (JADEPUFFER) Multi-service-principal Azure enumeration preceding destructive activity
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Microsoft Sentinel (KQL)
