Detection rules › Panther
Azure Key Vault Secret Accessed or Recovered
Detects when Azure Key Vault secrets are accessed or when soft-deleted secrets are recovered. Recovering soft-deleted secrets may indicate an attacker attempting to extract previously deleted credentials.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1555 Credentials from Password Stores |
| Collection | T1530 Data from Cloud Storage |
Rule body yaml
AnalysisType: rule
Filename: azure_keyvault_secret_accessed_or_recovered.py
RuleID: "Azure.MonitorActivity.KeyVault.SecretAccessedOrRecovered"
DisplayName: "Azure Key Vault Secret Accessed or Recovered"
Enabled: true
LogTypes:
- Azure.MonitorActivity
Severity: Medium
Description: >
Detects when Azure Key Vault secrets are accessed or when soft-deleted secrets are recovered.
Recovering soft-deleted secrets may indicate an attacker attempting to extract previously deleted credentials.
Reports:
MITRE ATT&CK:
- TA0006:T1555 # Credential Access: Credentials from Password Stores
- TA0009:T1530 # Collection: Data from Cloud Storage
Tags:
- AZT604.1
- AZT704.3
- Credential Access
- Collection
- Credentials from Password Stores
- Data from Cloud Storage
Runbook: |
1. Query Azure Monitor Activity logs for all Key Vault operations by the callerIpAddress in the 6 hours before and after this alert to identify patterns of secret enumeration or bulk access
2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
3. Search for role assignment changes or privilege escalation events from the same identity in the 24 hours before this secret access to assess if the identity was recently compromised
Reference: https://blog.pwnedlabs.io/climbing-the-azure-ladder-part-1
SummaryAttributes:
- resourceId
- callerIpAddress
- correlationId
Tests:
- Name: Secret Accessed
ExpectedResult: true
Log:
{
"time": "2024-12-17T10:30:00.0000000Z",
"resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/myvault/secrets/database-password",
"operationName": "Microsoft.KeyVault/vaults/secrets/getSecret/action",
"operationVersion": "7.0",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "1.1.1.1",
"location": "eastus",
"correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"identity": {
"claims": {
"appid": "12345678-1234-1234-1234-123456789abc"
}
},
"tenantId": "87654321-4321-4321-4321-111111111111"
}
- Name: Soft-Deleted Secret Recovered
ExpectedResult: true
Log:
{
"time": "2024-12-17T11:00:00.0000000Z",
"resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/prodvault/secrets/admin-credentials",
"operationName": "Microsoft.KeyVault/vaults/secrets/recover/action",
"operationVersion": "7.0",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "2.2.2.2",
"location": "westus",
"correlationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"identity": {
"claims": {
"appid": "87654321-4321-4321-4321-123456789abc"
}
},
"tenantId": "87654321-4321-4321-4321-111111111111"
}
- Name: Case Insensitive Match
ExpectedResult: true
Log:
{
"time": "2024-12-17T12:00:00.0000000Z",
"resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/security-rg/providers/Microsoft.KeyVault/vaults/secvault/secrets/api-token",
"operationName": "microsoft.keyvault/vaults/secrets/getsecret/action",
"operationVersion": "7.0",
"category": "Administrative",
"resultType": "Succeeded",
"callerIpAddress": "3.3.3.3",
"location": "centralus",
"correlationId": "c3d4e5f6-a7b8-9012-cdef-222222222222",
"tenantId": "87654321-4321-4321-4321-111111111111"
}
- Name: Different Operation
ExpectedResult: false
Log:
{
"time": "2024-12-17T14:00:00.0000000Z",
"resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/myvault/secrets/secret2",
"operationName": "Microsoft.KeyVault/vaults/secrets/write",
"operationVersion": "7.0",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "5.5.5.5",
"location": "eastus",
"correlationId": "e5f6a7b8-c9d0-1234-ef01-345678901234",
"tenantId": "87654321-4321-4321-4321-111111111111"
}
Detection logic
Condition
operationName in ["MICROSOFT.KEYVAULT/VAULTS/SECRETS/GETSECRET/ACTION", "MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION", "MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION"]
resultType in ["Success", "Succeeded"]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
operationName | in |
|
resultType | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
callerIpAddress |