Key Eater: Service principal sign-in from new IP followed by Key Vault secret
Detects workload identity sign-ins from an IP /24 not seen for that service principal in the prior 30 days, followed by bulk Azure Key Vault secret reads by the same service principal within 1 hour, characteristic of Storm-0940 credential abuse and exfiltration.
Microsoft Sentinel (KQL)
