Windows Cloud Sensitive File Read Access By Uncommon Process — Detection Rule
This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints. It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure. Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants. This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.