Azure Key Vault Key Permanently Purged

AnalysisType: rule
Filename: azure_keyvault_key_purged.py
RuleID: "Azure.MonitorActivity.KeyVault.KeyPurged"
DisplayName: "Azure Key Vault Key Permanently Purged"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Info
Description: >
  Detects when an Azure Key Vault key is permanently purged.
  Purging a key is an irreversible operation that permanently destroys cryptographic keys.
  If done on an unrecognized key, it may indicate ransomware or malicious destruction.
Reports:
  MITRE ATT&CK:
    - TA0040:T1485 # Impact: Data Destruction
    - TA0040:T1490 # Impact: Inhibit System Recovery
Tags:
  - Impact
  - Data Destruction
  - Inhibit System Recovery
  - Ransomware
Runbook: |
  1. Query Azure Monitor Activity logs for all Key Vault operations by the callerIpAddress in the 24 hours before this alert to identify if multiple keys or secrets are being purged
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for other Azure Key Vault deletions, purges, or destructive operations from the same user or IP in the past 7 days to assess the scope of potential data destruction
Reference: https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Key Purged
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault/keys/mykey",
        "operationName": "Microsoft.KeyVault/vaults/keys/purge/action",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.KeyVault/vaults/prodvault/keys/encryptionkey",
        "operationName": "microsoft.keyvault/vaults/keys/purge/action",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault/keys/mykey",
        "operationName": "Microsoft.KeyVault/vaults/keys/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-234567890123",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-210987654321"
      }

# ------ paired body: azure_keyvault_key_purged.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

KEYVAULT_KEY_PURGE = "MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION"


def rule(event):
    return event.get("operationName", "").upper() == KEYVAULT_KEY_PURGE and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "")
    keyvault = extract_resource_name_from_id(resource_id, "vaults", default="<UNKNOWN_KEYVAULT>")
    caller = event.get("callerIpAddress", default="<UNKNOWN_CALLER>")

    return f"Azure Key Vault key permanently purged on [{keyvault}] from [{caller}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")
    keyvault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    key_name = extract_resource_name_from_id(resource_id, "keys", default="")

    if keyvault_name:
        context["keyvault_name"] = keyvault_name
    if key_name:
        context["key_name"] = key_name

    return context