Detects when a user accesses a high-value secret for the first time, with no access to that same secret by that user in the prior 14 days. First-time access to a sensitive secret can indicate lateral movement or credential targeting. Delinea reports no in-band sensitivity flag, so a secret is treated as high-value when its name or its folder matches 'sensitivePattern' (common privileged naming conventions), or when it appears in 'customSecretNames' / 'customFolders'. Both knobs are meant to be edited at deployment time - the pattern for substring matching, the lists for exact tenant-specific names. The folder is read from the notes document, since the platform leaves the top-level target.containerName empty on secret events.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.