Azure Key Vault Secret Accessed or Recovered

Description

Detects when Azure Key Vault secrets are accessed or when soft-deleted secrets are recovered. Recovering soft-deleted secrets may indicate an attacker attempting to extract previously deleted credentials.

Query · python

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

SECRET_GET = "MICROSOFT.KEYVAULT/VAULTS/SECRETS/GETSECRET/ACTION"  # nosec B105
SECRET_RECOVER = "MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION"  # nosec B105
SECRET_RESTORE = "MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION"  # nosec B105


def rule(event):
    operation = event.get("operationName", "").upper()
    return all(
        [
            operation in [SECRET_GET, SECRET_RECOVER, SECRET_RESTORE],
            azure_activity_success(event),
        ]
    )


def title(event):
    operation = event.get("operationName", "").upper()
    resource_id = event.get("resourceId", "")
    keyvault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    caller = event.get("callerIpAddress", default="<UNKNOWN_CALLER>")

    if operation == SECRET_RECOVER:
        return (
            f"Azure Key Vault soft-deleted secret recovered "
            f"from [{keyvault_name}] by [{caller}]"
        )

    return f"Azure Key Vault secret accessed from [{keyvault_name}] by [{caller}]"


def severity(event):
    operation = event.get("operationName", "").upper()
    # Recovering soft-deleted secrets is more suspicious
    if operation == SECRET_RECOVER:
        return "MEDIUM"
    return "DEFAULT"


def alert_context(event):
    context = azure_activity_alert_context(event)
    resource_id = event.get("resourceId", "")

    keyvault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    if keyvault_name:
        context["keyvault_name"] = keyvault_name

    secret_name = extract_resource_name_from_id(resource_id, "secrets", default="")
    if secret_name:
        context["secret_name"] = secret_name

    return context

Analyst notes

  1. Query Azure Monitor Activity logs for all Key Vault operations by the callerIpAddress in the 6 hours before and after this alert to identify patterns of secret enumeration or bulk access
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for role assignment changes or privilege escalation events from the same identity in the 24 hours before this secret access to assess if the identity was recently compromised
Raw source Azure Key Vault Secret Accessed or Recovered · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: azure_keyvault_secret_accessed_or_recovered.py
RuleID: "Azure.MonitorActivity.KeyVault.SecretAccessedOrRecovered"
DisplayName: "Azure Key Vault Secret Accessed or Recovered"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Medium
Description: >
  Detects when Azure Key Vault secrets are accessed or when soft-deleted secrets are recovered.
  Recovering soft-deleted secrets may indicate an attacker attempting to extract previously deleted credentials.
Reports:
  MITRE ATT&CK:
    - TA0006:T1555 # Credential Access: Credentials from Password Stores
    - TA0009:T1530 # Collection: Data from Cloud Storage
Tags:
  - AZT604.1
  - AZT704.3
  - Credential Access
  - Collection
  - Credentials from Password Stores
  - Data from Cloud Storage
Runbook: |
  1. Query Azure Monitor Activity logs for all Key Vault operations by the callerIpAddress in the 6 hours before and after this alert to identify patterns of secret enumeration or bulk access
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for role assignment changes or privilege escalation events from the same identity in the 24 hours before this secret access to assess if the identity was recently compromised
Reference: https://blog.pwnedlabs.io/climbing-the-azure-ladder-part-1
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Secret Accessed
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/myvault/secrets/database-password",
        "operationName": "Microsoft.KeyVault/vaults/secrets/getSecret/action",
        "operationVersion": "7.0",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.1.1.1",
        "location": "eastus",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "identity": {
          "claims": {
            "appid": "12345678-1234-1234-1234-123456789abc"
          }
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Soft-Deleted Secret Recovered
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/prodvault/secrets/admin-credentials",
        "operationName": "Microsoft.KeyVault/vaults/secrets/recover/action",
        "operationVersion": "7.0",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "2.2.2.2",
        "location": "westus",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "identity": {
          "claims": {
            "appid": "87654321-4321-4321-4321-123456789abc"
          }
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T12:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/security-rg/providers/Microsoft.KeyVault/vaults/secvault/secrets/api-token",
        "operationName": "microsoft.keyvault/vaults/secrets/getsecret/action",
        "operationVersion": "7.0",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "3.3.3.3",
        "location": "centralus",
        "correlationId": "c3d4e5f6-a7b8-9012-cdef-222222222222",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T14:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/myvault/secrets/secret2",
        "operationName": "Microsoft.KeyVault/vaults/secrets/write",
        "operationVersion": "7.0",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "5.5.5.5",
        "location": "eastus",
        "correlationId": "e5f6a7b8-c9d0-1234-ef01-345678901234",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }

# ------ paired body: azure_keyvault_secret_accessed_or_recovered.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

SECRET_GET = "MICROSOFT.KEYVAULT/VAULTS/SECRETS/GETSECRET/ACTION"  # nosec B105
SECRET_RECOVER = "MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION"  # nosec B105
SECRET_RESTORE = "MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION"  # nosec B105


def rule(event):
    operation = event.get("operationName", "").upper()
    return all(
        [
            operation in [SECRET_GET, SECRET_RECOVER, SECRET_RESTORE],
            azure_activity_success(event),
        ]
    )


def title(event):
    operation = event.get("operationName", "").upper()
    resource_id = event.get("resourceId", "")
    keyvault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    caller = event.get("callerIpAddress", default="<UNKNOWN_CALLER>")

    if operation == SECRET_RECOVER:
        return (
            f"Azure Key Vault soft-deleted secret recovered "
            f"from [{keyvault_name}] by [{caller}]"
        )

    return f"Azure Key Vault secret accessed from [{keyvault_name}] by [{caller}]"


def severity(event):
    operation = event.get("operationName", "").upper()
    # Recovering soft-deleted secrets is more suspicious
    if operation == SECRET_RECOVER:
        return "MEDIUM"
    return "DEFAULT"


def alert_context(event):
    context = azure_activity_alert_context(event)
    resource_id = event.get("resourceId", "")

    keyvault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    if keyvault_name:
        context["keyvault_name"] = keyvault_name

    secret_name = extract_resource_name_from_id(resource_id, "secrets", default="")
    if secret_name:
        context["secret_name"] = secret_name

    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.