Keyvault - CraftedSignal Threat Feed

Azure Key Vault Excessive Secret or Key Retrieval

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

This rule identifies excessive secret or key retrieval operations from Azure Key Vault, a cloud service safeguarding encryption keys and secrets. The rule detects instances where a user principal retrieves secrets or keys from Azure Key Vault multiple times within a short timeframe, potentially indicating abuse or unauthorized access attempts. The rule focuses on high-frequency retrieval operations that deviate from normal user behavior, suggesting credential harvesting or misuse of sensitive information. An adversary might abuse a FOCI (Foreign Ownership, Control, or Influence) compliant application to evade security controls or conditional access policies, and use that to access the secrets. Published on 2026-04-10, this rule is designed to alert on potentially malicious behavior within Azure environments using data ingested into Elastic.

Attack Chain

An attacker gains initial access to an Azure environment, potentially through compromised credentials or exploiting a vulnerability.
The attacker identifies an Azure Key Vault containing sensitive secrets or keys.
The attacker attempts to retrieve secrets or keys from the Key Vault using valid or stolen credentials.
The attacker iterates through various Key Vault resources, attempting to access a wide range of secrets.
The attacker's activity generates multiple "KeyGet", "SecretGet", or "CertificateGet" events within a short time frame, triggering the detection rule.
The attacker exfiltrates the retrieved secrets or keys for use in further malicious activities.
The attacker uses the obtained credentials to access sensitive data or systems.
The attacker achieves their objective, such as data theft or unauthorized system access.

Impact

Excessive key and secret retrievals can indicate that an attacker is attempting to compromise sensitive data stored within Azure Key Vault. Successful credential access can lead to unauthorized access to other Azure resources, data breaches, and service disruptions. The rule is triggered when a principal retrieves more than 10 key vault items and at least 2 distinct actions in a 1 minute window. This can lead to significant financial and reputational damage depending on the sensitivity of the compromised data.

Recommendation

Enable Azure Key Vault diagnostic logs, specifically the AuditEvent log, to capture read and write operations (as mentioned in the rule's setup section).
Deploy the provided Sigma rule "Azure Key Vault Excessive Secret Retrieval via UPN" to your SIEM to detect suspicious retrieval activity based on User Principal Name, tuning the threshold (Esql.event_count >= 10) for your environment.
Investigate alerts triggered by the Sigma rule by reviewing the azure.platformlogs.identity.claim.upn, azure.platformlogs.identity.claim.appid, and source.ip fields in the logs to identify the source and user involved.
Implement stricter access controls and policies for Key Vaults to limit excessive retrievals, ensuring only authorized users and applications can access sensitive keys and secrets.
Triage users flagged by this rule with Entra ID sign-in logs to gather more context about their authentication behavior, as described in the rule's "Triage and Analysis" section.

Azure Key Vault Unusual Secret Key Usage

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies anomalous access patterns to Azure Key Vault, a critical service for securely storing secrets, keys, and certificates in Azure environments. Specifically, it focuses on the retrieval of sensitive information (secrets, keys, certificates) by user principals that have not historically accessed the resource. The rule leverages the new_terms aggregation to identify previously unseen user principal names (UPNs) accessing Key Vault resources. This aims to uncover potential credential compromise, insider threats, or the use of rogue applications to exfiltrate sensitive data. This activity can lead to data breaches or unauthorized access to critical systems and resources within the Azure environment. The rule is based on the Elastic detection rule "Azure Key Vault Unusual Secret Key Usage", version updated on 2026-04-10.

Attack Chain

An attacker gains unauthorized access to an Azure account or obtains valid credentials through phishing, credential stuffing, or other means (Initial Access).
The attacker leverages the compromised credentials to authenticate to the Azure environment.
The attacker enumerates available Azure Key Vault resources to identify potential targets (Discovery).
The attacker attempts to retrieve secrets, keys, or certificates from a Key Vault using the compromised credentials (Credential Access). The specific actions observed include "VaultGet", "KeyGet", "SecretGet", and "CertificateGet".
If successful, the attacker gains access to sensitive information stored within the Key Vault, such as API keys, database passwords, or encryption keys (Credential Access).
The attacker uses the retrieved credentials to further compromise other systems or resources within the Azure environment, such as databases, applications, or virtual machines (Lateral Movement, Privilege Escalation).
The attacker may exfiltrate the retrieved secrets and use them to gain access to external systems or services (Exfiltration).

Impact

Successful exploitation can lead to the compromise of sensitive data stored within Azure Key Vault, including API keys, database passwords, and encryption keys. This can result in unauthorized access to critical systems and resources, data breaches, and financial losses. The number of victims and sectors targeted depends on the specific Key Vault resources compromised and the systems that rely on those resources.

Recommendation

Enable Azure Key Vault Diagnostic Logs, specifically the AuditEvent log, and stream them to a SIEM or monitoring platform to capture all read and write operations (Setup section in Content).
Deploy the Sigma rule "Azure Key Vault Unusual Secret Key Usage" to detect unusual access patterns to Azure Key Vault resources (see Rules section).
Investigate any alerts generated by the Sigma rule, focusing on identifying the user principal making the retrieval requests and the specific Key Vault being accessed (see Investigation steps in Content).
Implement stricter access controls and policies for Key Vaults to limit excessive retrievals and ensure that only authorized users and applications can access sensitive keys and secrets (see Response and remediation in Content).

Azure Key Vault Modified by Unusual User

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies modifications to Azure Key Vault, a service that safeguards encryption keys and secrets. Given the sensitivity of the data stored, access should be tightly controlled. This detection uses a new terms rule to identify when Key Vault modifications are performed by a user who hasn't been seen performing this activity within a 14-day period. This activity could indicate compromised credentials, insider threats, or misconfigured access controls. This rule helps security teams quickly identify and respond to potentially unauthorized modifications to sensitive resources within Azure environments, specifically targeting unusual user activity that deviates from established baselines. The original rule was created on 2020/08/31, and updated on 2026/04/10.

Attack Chain

An attacker gains unauthorized access to an Azure account, potentially through credential compromise or account takeover.
The attacker leverages the compromised account to authenticate to the Azure environment.
The attacker enumerates available Key Vault resources within the Azure subscription.
The attacker attempts to modify a Key Vault configuration, such as changing access policies, secrets, or encryption keys.
The modification is logged as an Azure Activity Log event with operation name MICROSOFT.KEYVAULT/VAULTS/* and event outcome of Success.
The "new terms" rule triggers because the user performing the modification (azure.activitylogs.identity.claims_initiated_by_user.name) is not a known user of Key Vaults, based on a 14-day history.
The attacker leverages the modified Key Vault configuration to access sensitive data or disrupt services.
The attacker may further attempt to cover their tracks by deleting audit logs or other evidence of their activity.

Impact

Unauthorized modifications to Azure Key Vault can have significant consequences, including data breaches, service disruptions, and compliance violations. The rule has a low severity and a risk score of 21. If an attacker successfully modifies a Key Vault, they could potentially access sensitive secrets and encryption keys, leading to the compromise of critical applications and data. This could affect multiple organizations that rely on the compromised Key Vault for securing their cloud infrastructure.

Recommendation

Deploy the Sigma rules provided in this brief to your SIEM to detect unusual Key Vault modifications.
Investigate any alerts generated by the Sigma rules, focusing on the user (azure.activitylogs.identity.claims_initiated_by_user.name), the Key Vault resource ID (azure.activitylogs.resource_id), and the type of modification (azure.activitylogs.operation_name).
Review Azure Key Vault access policies and ensure that only authorized users and applications have the necessary permissions.
Enable multi-factor authentication (MFA) for all Azure accounts, especially those with access to sensitive resources like Key Vaults.
Monitor Azure Activity Logs for any suspicious activity related to Key Vault modifications (Data Source: Azure Activity Logs).