Identifies the first time in seven days that a high-privilege Azure principal lists or regenerates the API keys of a Microsoft Foundry (Azure AI Services) account, or reads the stored secrets of a Foundry account or project connection. Account keys grant direct inference access to every model deployment on the account and bypass Entra ID conditional access, and connection secrets hold credentials for downstream services such as Azure OpenAI, storage, and search. A compromised identity retrieving these keys is a common first step in LLMjacking and in pivoting from a Foundry project to the data it is connected to.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.