Azure Key Vault Key Accessed or Recovered

Description

Detects when Azure Key Vault cryptographic keys are accessed via read operations or recovered/restored. Key Vault keys contain public key information used for encryption, decryption, and signing operations. While private keys cannot be directly exported from Key Vault, adversaries may access key metadata and properties to understand the encryption architecture, identify sensitive keys, or enumerate available cryptographic resources for targeted attacks.

Query · python

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

KEY_READ = "MICROSOFT.KEYVAULT/VAULTS/KEYS/READ/ACTION"
KEY_RESTORED = "MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION"
KEY_RECOVERED = "MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION"


def rule(event):
    operation = event.get("operationName", "").upper()
    return operation in [KEY_READ, KEY_RESTORED, KEY_RECOVERED] and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "")
    keyvault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    caller = event.get("callerIpAddress", default="<UNKNOWN_CALLER>")
    operation = event.get("operationName", "").upper()
    action = None
    if operation == KEY_READ:
        action = "read"
    elif operation == KEY_RESTORED:
        action = "restored"
    elif operation == KEY_RECOVERED:
        action = "recovered"
    if action is not None:
        return f"Azure Key Vault key {action} from [{keyvault_name}] by [{caller}]"
    return f"Azure Key Vault key accessed from [{keyvault_name}] by [{caller}]"


def alert_context(event):
    context = azure_activity_alert_context(event)
    resource_id = event.get("resourceId", "")
    keyvault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    if keyvault_name:
        context["keyvault_name"] = keyvault_name

    key_name = extract_resource_name_from_id(resource_id, "keys", default="")
    if key_name:
        context["key_name"] = key_name

    return context

Analyst notes

  1. Find all Key Vault key, certificate, and secret operations by the callerIpAddress in the 6 hours before and after this alert to identify patterns of credential enumeration
  2. Query for the key usage to determine which applications or services rely on this key for encryption operations
  3. Check if the identity accessing the key has performed similar Key Vault operations in the past 30 days to determine if this is normal behavior
Raw source Azure Key Vault Key Accessed or Recovered · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: azure_keyvault_key_accessed_or_recovered.py
RuleID: "Azure.MonitorActivity.KeyVault.KeyAccessed.Recovered"
DisplayName: "Azure Key Vault Key Accessed or Recovered"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Medium
Description: >
  Detects when Azure Key Vault cryptographic keys are accessed via read operations or recovered/restored.
  Key Vault keys contain public key information used for encryption, decryption, and signing operations.
  While private keys cannot be directly exported from Key Vault, adversaries may access key metadata
  and properties to understand the encryption architecture, identify sensitive keys, or enumerate
  available cryptographic resources for targeted attacks.
Reports:
  MITRE ATT&CK:
    - TA0006:T1555 # Credential Access: Credentials from Password Stores
    - TA0007:T1087.004 # Discovery: Account Discovery - Cloud Account
Tags:
  - AZT604
  - AZT604.3
  - AZT704
  - AZT704.1
  - Credential Access
  - Discovery
  - Credentials from Password Stores
  - Account Discovery
  - Cloud Account
Runbook: |
  1. Find all Key Vault key, certificate, and secret operations by the callerIpAddress in the 6 hours before and after this alert to identify patterns of credential enumeration
  2. Query for the key usage to determine which applications or services rely on this key for encryption operations
  3. Check if the identity accessing the key has performed similar Key Vault operations in the past 30 days to determine if this is normal behavior
Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/CredentialAccess/AZT604/AZT604-3
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Key Read Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/myvault/keys/encryption-key",
        "operationName": "Microsoft.KeyVault/vaults/keys/read/action",
        "operationVersion": "7.0",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.1.1.1",
        "location": "eastus",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "identity": {
          "claims": {
            "appid": "12345678-1234-1234-1234-123456789abc"
          }
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Key Recovered Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T11:00:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/prod-rg/providers/Microsoft.KeyVault/vaults/prodvault/keys/signing-key",
        "operationName": "Microsoft.KeyVault/vaults/keys/recover/action",
        "operationVersion": "7.0",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "location": "westus",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "identity": {
          "claims": {
            "appid": "87654321-4321-4321-4321-123456789abc"
          }
        },
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Key Restored Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T12:00:00.0000000Z",
        "resourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourceGroups/security-rg/providers/Microsoft.KeyVault/vaults/secvault/keys/master-key",
        "operationName": "microsoft.keyvault/vaults/keys/restore/action",
        "operationVersion": "7.0",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "3.3.3.3",
        "location": "centralus",
        "correlationId": "c3d4e5f6-a7b8-9012-cdef-333333333333",
        "tenantId": "33333333-3333-3333-3333-333333333333"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-23T14:00:00.0000000Z",
        "resourceId": "/subscriptions/55555555-5555-5555-5555-555555555555/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/myvault/keys/key2",
        "operationName": "Microsoft.KeyVault/vaults/keys/write",
        "operationVersion": "7.0",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "5.5.5.5",
        "location": "eastus",
        "correlationId": "e5f6a7b8-c9d0-1234-ef01-555555555555",
        "tenantId": "55555555-5555-5555-5555-555555555555"
      }

# ------ paired body: azure_keyvault_key_accessed_or_recovered.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

KEY_READ = "MICROSOFT.KEYVAULT/VAULTS/KEYS/READ/ACTION"
KEY_RESTORED = "MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION"
KEY_RECOVERED = "MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION"


def rule(event):
    operation = event.get("operationName", "").upper()
    return operation in [KEY_READ, KEY_RESTORED, KEY_RECOVERED] and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "")
    keyvault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    caller = event.get("callerIpAddress", default="<UNKNOWN_CALLER>")
    operation = event.get("operationName", "").upper()
    action = None
    if operation == KEY_READ:
        action = "read"
    elif operation == KEY_RESTORED:
        action = "restored"
    elif operation == KEY_RECOVERED:
        action = "recovered"
    if action is not None:
        return f"Azure Key Vault key {action} from [{keyvault_name}] by [{caller}]"
    return f"Azure Key Vault key accessed from [{keyvault_name}] by [{caller}]"


def alert_context(event):
    context = azure_activity_alert_context(event)
    resource_id = event.get("resourceId", "")
    keyvault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    if keyvault_name:
        context["keyvault_name"] = keyvault_name

    key_name = extract_resource_name_from_id(resource_id, "keys", default="")
    if key_name:
        context["key_name"] = key_name

    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.