Sensitive Azure Key Vault operations

Status: available
Severity: low
Time window: 1d
Group by: Resource, ResourceType, ResultType, clientInfo_s, identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g, identity_claim_upn_s
Source: github.com/Azure/Azure-Sentinel

'Identifies when sensitive Azure Key Vault operations are used. This includes: VaultDelete, KeyDelete, SecretDelete, SecretPurge, KeyPurge, SecretBackup, KeyBackup. Any Backup operations should match with expected scheduled backup activity.'

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1485` Data Destruction

Rules detecting the same action

These rules filter on the same operation.

Azure Key Vault access TimeSeries anomaly (Kusto)
NRT Sensitive Azure Key Vault operations (Kusto)

Rule body

id: d6491be0-ab2d-439d-95d6-ad8ea39277c5
name: Sensitive Azure Key Vault operations
description: |
  'Identifies when sensitive Azure Key Vault operations are used. This includes: VaultDelete, KeyDelete, SecretDelete, SecretPurge, KeyPurge, SecretBackup, KeyBackup.
  Any Backup operations should match with expected scheduled backup activity.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: AzureKeyVault
    dataTypes:
      - KeyVaultData
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1485
query: |
  let SensitiveOperationList = dynamic(
  ["VaultDelete", "KeyDelete", "SecretDelete", "SecretPurge", "KeyPurge", "SecretBackup", "KeyBackup"]);
  AzureDiagnostics
  | extend ResultType = column_ifexists("ResultType", "NoResultType"), 
  requestUri_s = column_ifexists("requestUri_s", "None"), 
  identity_claim_oid_g = column_ifexists("identity_claim_oid_g", "None"), CallerIPAddress = column_ifexists("CallerIPAddress", "None"), 
  clientInfo_s = column_ifexists("clientInfo_s", "None"), 
  identity_claim_upn_s = column_ifexists("identity_claim_upn_s", "None"),
  identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g = column_ifexists("identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g", "None")
  | where ResourceType =~ "VAULTS" and ResultType =~ "Success"
  | where OperationName in~ (SensitiveOperationList)
  | summarize EventCount=count(), StartTimeUtc=min(TimeGenerated), EndTimeUtc=max(TimeGenerated), TimeTriggered=make_list(TimeGenerated),OperationNameList=make_set(OperationName), RequestURLList=make_set(requestUri_s), CallerIPList = make_set(CallerIPAddress),  CallerIPMax= arg_max(CallerIPAddress,*) by ResourceType, ResultType, Resource, identity_claim_upn_s, clientInfo_s, identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g
  | extend timestamp = StartTimeUtc
  | extend Name = tostring(split(identity_claim_upn_s,'@',0)[0]), UPNSuffix = tostring(split(identity_claim_upn_s,'@',1)[0]), AadUserId = identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g 
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: AadUserId
      - identifier: Name
        columnName: Name
      - identifier: UPNSuffix
        columnName: UPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: CallerIPMax
version: 1.0.4
kind: Scheduled

Stages and Predicates

Let binding: `SensitiveOperationList` used in Stage 4

let SensitiveOperationList = dynamic(
["VaultDelete", "KeyDelete", "SecretDelete", "SecretPurge", "KeyPurge", "SecretBackup", "KeyBackup"]);

Stage 1: `source`

AzureDiagnostics

Stage 2: `extend`

| extend ResultType = column_ifexists("ResultType", "NoResultType"), 
requestUri_s = column_ifexists("requestUri_s", "None"), 
identity_claim_oid_g = column_ifexists("identity_claim_oid_g", "None"), CallerIPAddress = column_ifexists("CallerIPAddress", "None"), 
clientInfo_s = column_ifexists("clientInfo_s", "None"), 
identity_claim_upn_s = column_ifexists("identity_claim_upn_s", "None"),
identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g = column_ifexists("identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g", "None")

Stage 3: `where`

| where ResourceType =~ "VAULTS" and ResultType =~ "Success"

Stage 4: `where`

| where OperationName in~ (SensitiveOperationList)

Stage 5: `summarize`

| summarize EventCount=count(), StartTimeUtc=min(TimeGenerated), EndTimeUtc=max(TimeGenerated), TimeTriggered=make_list(TimeGenerated),OperationNameList=make_set(OperationName), RequestURLList=make_set(requestUri_s), CallerIPList = make_set(CallerIPAddress),  CallerIPMax= arg_max(CallerIPAddress,*) by ResourceType, ResultType, Resource, identity_claim_upn_s, clientInfo_s, identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g

Stage 6: `extend`

| extend timestamp = StartTimeUtc

Stage 7: `extend`

| extend Name = tostring(split(identity_claim_upn_s,'@',0)[0]), UPNSuffix = tostring(split(identity_claim_upn_s,'@',1)[0]), AadUserId = identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`OperationName`	in	`KeyBackup` `KeyDelete` `KeyPurge` `SecretBackup` `SecretDelete` `SecretPurge` `VaultDelete`	`field:"OperationName" kind:in`
`ResourceType`	eq	`VAULTS`	`field:"ResourceType" kind:eq value:"VAULTS"`
`ResultType`	eq	`Success`	`field:"ResultType" kind:eq value:"Success"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CallerIPList`	`summarize`
`CallerIPMax`	`summarize`
`EndTimeUtc`	`summarize`
`EventCount`	`summarize`
`OperationNameList`	`summarize`
`RequestURLList`	`summarize`
`Resource`	`summarize`
`ResourceType`	`summarize`
`ResultType`	`summarize`
`StartTimeUtc`	`summarize`
`TimeTriggered`	`summarize`
`clientInfo_s`	`summarize`
`identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g`	`summarize`
`identity_claim_upn_s`	`summarize`
`timestamp`	`extend`
`AadUserId`	`extend`
`Name`	`extend`
`UPNSuffix`	`extend`

Sensitive Azure Key Vault operations

MITRE ATT&CK coverage

Rules detecting the same action

Rule body

Stages and Predicates

Let binding: SensitiveOperationList used in Stage 4

Stage 1: source

Stage 2: extend

Stage 3: where

Stage 4: where

Stage 5: summarize

Stage 6: extend

Stage 7: extend