Detection rules › Panther
Azure Key Vault Key Permanently Purged
Detects when an Azure Key Vault key is permanently purged. Purging a key is an irreversible operation that permanently destroys cryptographic keys. If done on an unrecognized key, it may indicate ransomware or malicious destruction.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact | T1485 Data Destruction, T1490 Inhibit System Recovery |
Rule body yaml
AnalysisType: rule
Filename: azure_keyvault_key_purged.py
RuleID: "Azure.MonitorActivity.KeyVault.KeyPurged"
DisplayName: "Azure Key Vault Key Permanently Purged"
Enabled: true
LogTypes:
- Azure.MonitorActivity
Severity: Info
Description: >
Detects when an Azure Key Vault key is permanently purged.
Purging a key is an irreversible operation that permanently destroys cryptographic keys.
If done on an unrecognized key, it may indicate ransomware or malicious destruction.
Reports:
MITRE ATT&CK:
- TA0040:T1485 # Impact: Data Destruction
- TA0040:T1490 # Impact: Inhibit System Recovery
Tags:
- Impact
- Data Destruction
- Inhibit System Recovery
- Ransomware
Runbook: |
1. Query Azure Monitor Activity logs for all Key Vault operations by the callerIpAddress in the 24 hours before this alert to identify if multiple keys or secrets are being purged
2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
3. Search for other Azure Key Vault deletions, purges, or destructive operations from the same user or IP in the past 7 days to assess the scope of potential data destruction
Reference: https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview
SummaryAttributes:
- resourceId
- callerIpAddress
- correlationId
Tests:
- Name: Key Purged
ExpectedResult: true
Log:
{
"time": "2024-12-17T10:30:00.0000000Z",
"resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault/keys/mykey",
"operationName": "Microsoft.KeyVault/vaults/keys/purge/action",
"operationVersion": "2021-04-01",
"category": "Administrative",
"resultType": "Success",
"resultSignature": "200",
"callerIpAddress": "1.1.1.1",
"correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"location": "eastus",
"tenantId": "87654321-4321-4321-4321-111111111111"
}
- Name: Case Insensitive Match
ExpectedResult: true
Log:
{
"time": "2024-12-17T11:45:00.0000000Z",
"resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.KeyVault/vaults/prodvault/keys/encryptionkey",
"operationName": "microsoft.keyvault/vaults/keys/purge/action",
"operationVersion": "2021-04-01",
"category": "Administrative",
"resultType": "Succeeded",
"callerIpAddress": "1.2.3.4",
"correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
"location": "eastus",
"tenantId": "87654321-4321-4321-4321-111111111111"
}
- Name: Different Operation
ExpectedResult: false
Log:
{
"time": "2024-12-17T13:30:00.0000000Z",
"resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault/keys/mykey",
"operationName": "Microsoft.KeyVault/vaults/keys/delete",
"operationVersion": "2021-04-01",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "1.2.3.4",
"correlationId": "d4e5f6a7-b8c9-0123-def0-234567890123",
"location": "eastus",
"tenantId": "87654321-4321-4321-4321-210987654321"
}
Detection logic
Condition
operationName eq "MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION"
resultType in ["Success", "Succeeded"]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
operationName | eq |
|
resultType | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
callerIpAddress |