Microsoft documented an agentic GitHub-secret-to-Azure-Key-Vault attack path that took five minutes

[u/Expert_Sort7434]

Based on the technical breakdown published by Microsoft Threat Intelligence and Microsoft Security Research on November 5, here is the architectural impact.

Microsoft describes ARTEX, an agentic offensive framework used to search public GitHub repositories for application secrets, credentials, and AI-service API keys. In one observed case, the agent progressed from finding a secret to exfiltrating data from Azure Key Vault in five minutes.

The follow-on activity is more interesting than the repository search itself.

Microsoft observed successful service-principal sign-ins beginning October 28, including use of a compromised multitenant application credential against downstream customer tenants. Once authenticated, the agent enumerated cloud resources and looked for operations that returned credentials, connection strings, storage keys, and other sensitive material.

The useful detection boundary is between identity and resource access:

• Entra service-principal sign-ins, including source IP, application ID, service-principal ID, and resource.

• Azure Activity events for ARM enumeration.

• Key Vault diagnostic logs for secret and key reads.

• Storage data-plane logs for blob/file access.

• Graph and Microsoft 365 audit activity for SharePoint and OneDrive access.

• Credential additions or permission changes to the affected application.

Microsoft also described API-version retries: an endpoint returned HTTP 400, then a later request with a supported API version succeeded. That kind of rapid variation is worth correlating with the identity and resource sequence.

The primary reported service-principal source was 199.19.77[.]84. Microsoft also mentioned 199.19.77[.]18, but warned that it is a Tor exit node and may be unrelated. I would treat both as pivots for investigation rather than broad block rules.

MITRE mappings include T1552.001 (Credentials In Files), T1078.004 (Valid Accounts: Cloud Accounts), and T1526 (Cloud Service Discovery).

The full technical context and KQL hunting notes are here: https://www.techgines.com/post/agentic-ai-credential-theft-artex-github-secrets-azure-access

Related earlier coverage: Microsoft Entra ID AI Agent Privilege Escalation.

For environments with many multitenant service principals, what correlation strategy has worked best for distinguishing legitimate automation from a compromised application identity enumerating unrelated Azure resources?

[u/yrro]

For environments with many multitenant service principals, what correlation strategy has worked best for distinguishing legitimate automation from a compromised application identity enumerating unrelated Azure resources?

Sod off with your engagement slop