Identifies a burst of successful Azure Key Vault SecretGet requests by the same principal and application across multiple vaults within a 15-minute window. The rule triggers when there are at least 20 successful secret reads (HTTP 200) across three or more vaults, within a 15-minute window, from a single issuer/tenant and application (identified via iss, oid, and appid). It relies on Azure Platform Logs events to aggregate reads, vaults, and source IPs, then buckets time into 15-minute windows. This pattern indicates potential credential access by compromised application credentials used to enumerate or exfiltrate secrets to enable lateral movement or broader service access. The query filters out non-authenticated or incomplete identities and ensures the read activity is tied to legitimate HTTP 200 outcomes, while recognizing that legitimate multi-vault inventory or deployment pipelines can produce similar bursts. The detection aligns with MITRE ATT&CK Credential Access (T1555, specifically T1555.006 Cloud Secrets Management Stores) and the Storm-0940 hunting pattern for cross-vault secret reads.