Azure DevOps Variable Secret Not Secured

Status: available
Severity: medium
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

'Credentials used in the build process may be stored as Azure DevOps variables. To secure these variables they should be stored in KeyVault or marked as Secrets. This detection looks for new variables added with names that suggest they are credentials but where they are not set as Secrets or stored in KeyVault.'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1552` Unsecured Credentials

Rule body

id: 4ca74dc0-8352-4ac5-893c-73571cc78331
name: Azure DevOps Variable Secret Not Secured
description: |
  'Credentials used in the build process may be stored as Azure DevOps variables. To secure these variables they should be stored in KeyVault or marked as Secrets. 
  This detection looks for new variables added with names that suggest they are credentials but where they are not set as Secrets or stored in KeyVault.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1552
query: |
  let keywords = dynamic(["secret", "secrets", "password", "PAT", "passwd", "pswd", "pwd", "cred", "creds", "credentials", "credential", "key"]);
  ADOAuditLogs
  | where OperationName =~ "Library.VariableGroupModified"
  | extend Type = tostring(Data.Type)
  | extend VariableGroupId = tostring(Data.VariableGroupId)
  | extend VariableGroupName = tostring(Data.VariableGroupName)
  | mv-expand Data.Variables
  | where VariableGroupName has_any (keywords) or Data_Variables has_any (keywords)
  | where Type != "AzureKeyVault"
  | where Data_Variables !has "IsSecret"
  | extend timestamp = TimeGenerated
  | extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorUPN
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IpAddress
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let keywords = dynamic(["secret", "secrets", "password", "PAT", "passwd", "pswd", "pwd", "cred", "creds", "credentials", "credential", "key"]);

Stage 1: `source`

ADOAuditLogs

Stage 2: `where`

| where OperationName =~ "Library.VariableGroupModified"

Stage 3: `extend` (3 consecutive steps)

| extend Type = tostring(Data.Type)
| extend VariableGroupId = tostring(Data.VariableGroupId)
| extend VariableGroupName = tostring(Data.VariableGroupName)

Stage 4: `mv-expand`

| mv-expand Data.Variables

Stage 5: `where`

| where VariableGroupName has_any (keywords) or Data_Variables has_any (keywords)

Stage 6: `where`

| where Type != "AzureKeyVault"

Stage 7: `where`

| where Data_Variables !has "IsSecret"

Stage 8: `extend`

| extend timestamp = TimeGenerated

Stage 9: `extend`

| extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Data_Variables`	match	`IsSecret`	`excludes:Data_Variables` `field:"Data_Variables" value:"IsSecret"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Data_Variables`	match	`PAT` transforms: `term` `cred` transforms: `term` `credential` transforms: `term` `credentials` transforms: `term` `creds` transforms: `term` `key` transforms: `term` `passwd` transforms: `term` `password` transforms: `term` `pswd` transforms: `term` `pwd` transforms: `term` `secret` transforms: `term` `secrets` transforms: `term`	`field:"Data_Variables" kind:match`
`OperationName`	eq	`Library.VariableGroupModified`	`field:"OperationName" kind:eq value:"Library.VariableGroupModified"`
`Type`	ne	`AzureKeyVault`	`field:"Type" kind:ne value:"AzureKeyVault"`
`VariableGroupName`	match	`PAT` transforms: `term` `cred` transforms: `term` `credential` transforms: `term` `credentials` transforms: `term` `creds` transforms: `term` `key` transforms: `term` `passwd` transforms: `term` `password` transforms: `term` `pswd` transforms: `term` `pwd` transforms: `term` `secret` transforms: `term` `secrets` transforms: `term`	`field:"VariableGroupName" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Type`	`extend`
`VariableGroupId`	`extend`
`VariableGroupName`	`extend`
`timestamp`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`

Azure DevOps Variable Secret Not Secured

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: extend (3 consecutive steps)

Stage 4: mv-expand

Stage 5: where

Stage 6: where

Stage 7: where

Stage 8: extend

Stage 9: extend