This anomaly analytic detects unusual Windows endpoint activity where an uncommon process reads or requests read access to sensitive cloud-provider files (Azure-related) by monitoring Windows Security Event 4663 for ReadData (AccessMask 0x1) operations. It targets read/list operations on token and profile files such as azureProfile.json, msal_token_cache.json, TokenCache.dat, and related Azure token artifacts. By excluding known legitimate tooling paths (e.g., Azure CLI Python interpreter, PowerShell, VS Code, Azure Dev CLI, and common code editors), the rule aims to surface credential theft or cloud-identity reconnaissance behavior, including observed patterns like Vidar Stealer variants. The detection aggregates by signature_id, signature, ObjectType, file_path, file_name, and process details, and annotates with firstTime/lastTime for the involved events. Implementation relies on enabling object access auditing (Audit File System) so that 4663 events are emitted for targeted files with a matching SACL. False positives can still arise from legitimate tooling or CI/CD agents that access Azure tokens from non-standard paths; tuning guidance emphasizes adding confirmed legitimate process/file paths to the windows_cloud_sensitive_file_read_access_by_uncommon_process_filter. The analytic maps to credential access risk and MITRE ATT&CK technique T1528 (Steal or Forge Credentials).