Detection rules › Panther
Azure Key Vault Key Accessed or Recovered
Detects when Azure Key Vault cryptographic keys are accessed via read operations or recovered/restored. Key Vault keys contain public key information used for encryption, decryption, and signing operations. While private keys cannot be directly exported from Key Vault, adversaries may access key metadata and properties to understand the encryption architecture, identify sensitive keys, or enumerate available cryptographic resources for targeted attacks.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1555 Credentials from Password Stores |
| Discovery | T1087.004 Account Discovery: Cloud Account |
Rule body yaml
AnalysisType: rule
Filename: azure_keyvault_key_accessed_or_recovered.py
RuleID: "Azure.MonitorActivity.KeyVault.KeyAccessed.Recovered"
DisplayName: "Azure Key Vault Key Accessed or Recovered"
Enabled: true
LogTypes:
- Azure.MonitorActivity
Severity: Medium
Description: >
Detects when Azure Key Vault cryptographic keys are accessed via read operations or recovered/restored.
Key Vault keys contain public key information used for encryption, decryption, and signing operations.
While private keys cannot be directly exported from Key Vault, adversaries may access key metadata
and properties to understand the encryption architecture, identify sensitive keys, or enumerate
available cryptographic resources for targeted attacks.
Reports:
MITRE ATT&CK:
- TA0006:T1555 # Credential Access: Credentials from Password Stores
- TA0007:T1087.004 # Discovery: Account Discovery - Cloud Account
Tags:
- AZT604
- AZT604.3
- AZT704
- AZT704.1
- Credential Access
- Discovery
- Credentials from Password Stores
- Account Discovery
- Cloud Account
Runbook: |
1. Find all Key Vault key, certificate, and secret operations by the callerIpAddress in the 6 hours before and after this alert to identify patterns of credential enumeration
2. Query for the key usage to determine which applications or services rely on this key for encryption operations
3. Check if the identity accessing the key has performed similar Key Vault operations in the past 30 days to determine if this is normal behavior
Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/CredentialAccess/AZT604/AZT604-3
SummaryAttributes:
- resourceId
- callerIpAddress
- correlationId
Tests:
- Name: Key Read Successfully
ExpectedResult: true
Log:
{
"time": "2025-12-23T10:30:00.0000000Z",
"resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/myvault/keys/encryption-key",
"operationName": "Microsoft.KeyVault/vaults/keys/read/action",
"operationVersion": "7.0",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "1.1.1.1",
"location": "eastus",
"correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"identity": {
"claims": {
"appid": "12345678-1234-1234-1234-123456789abc"
}
},
"tenantId": "87654321-4321-4321-4321-111111111111"
}
- Name: Key Recovered Successfully
ExpectedResult: true
Log:
{
"time": "2025-12-23T11:00:00.0000000Z",
"resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/prod-rg/providers/Microsoft.KeyVault/vaults/prodvault/keys/signing-key",
"operationName": "Microsoft.KeyVault/vaults/keys/recover/action",
"operationVersion": "7.0",
"category": "Administrative",
"resultType": "Succeeded",
"callerIpAddress": "2.2.2.2",
"location": "westus",
"correlationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"identity": {
"claims": {
"appid": "87654321-4321-4321-4321-123456789abc"
}
},
"tenantId": "22222222-2222-2222-2222-222222222222"
}
- Name: Key Restored Successfully
ExpectedResult: true
Log:
{
"time": "2025-12-23T12:00:00.0000000Z",
"resourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourceGroups/security-rg/providers/Microsoft.KeyVault/vaults/secvault/keys/master-key",
"operationName": "microsoft.keyvault/vaults/keys/restore/action",
"operationVersion": "7.0",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "3.3.3.3",
"location": "centralus",
"correlationId": "c3d4e5f6-a7b8-9012-cdef-333333333333",
"tenantId": "33333333-3333-3333-3333-333333333333"
}
- Name: Different Operation
ExpectedResult: false
Log:
{
"time": "2025-12-23T14:00:00.0000000Z",
"resourceId": "/subscriptions/55555555-5555-5555-5555-555555555555/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/myvault/keys/key2",
"operationName": "Microsoft.KeyVault/vaults/keys/write",
"operationVersion": "7.0",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "5.5.5.5",
"location": "eastus",
"correlationId": "e5f6a7b8-c9d0-1234-ef01-555555555555",
"tenantId": "55555555-5555-5555-5555-555555555555"
}
Detection logic
Condition
operationName in ["MICROSOFT.KEYVAULT/VAULTS/KEYS/READ/ACTION", "MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION", "MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION"]
resultType in ["Success", "Succeeded"]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
operationName | in |
|
resultType | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
callerIpAddress |