Service principal sign-in from actor IPs followed by Key Vault secret reads
Detects a sequence where a service principal successfully signs in from a suspicious or actor-linked IP address (including known Tor exit nodes), followed closely (within 1 hour) by Key Vault secret read operations (SecretGet or SecretList) originating from the same IP address.
Microsoft Sentinel (KQL)
