Update credential_access_multi_could_secrets_via_api.toml

Author: Samirbous

rules/cross-platform/credential_access_multi_could_secrets_via_api.toml

@@ -119,7 +119,7 @@ FROM logs-azure.platformlogs-*, logs-azure.activitylogs-*, logs-aws.cloudtrail-*
     (event.dataset == "azure.platformlogs" AND event.action IN ("SecretGet", "KeyGet")) or 
 
     /* Azure Key Vault (activity logs) */ 
-    (event.dataset == "azure.activitylogs" AND (azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/VAULTS/SECRETS/LIST" OR azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/VAULTS/SECRETS/GET")) OR 
+    (event.dataset == "azure.activitylogs" AND azure.activitylogs.operation_name IN ("MICROSOFT.KEYVAULT/VAULTS/SECRETS/LIST", "MICROSOFT.KEYVAULT/VAULTS/SECRETS/GET")) OR 
 
     /* Azure Managed HSM secret */ 
     (event.dataset == "azure.activitylogs" AND azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*") OR