huntrule

Azure Key Vault Key Modified or Deleted via Activity Log Operations

Alerts on Azure Key Vault key create/update/import/recover/restore/backup/purge/delete activity from Activity Logs.

FreeReviewedSigma · Medium · v5
Product
azure
Service
activitylogs
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-08-16
Updated
2026-07-31
AnalysisDetection
title: Azure Key Vault Key Modified or Deleted via Activity Log Operations
id: 50890364-4ffb-4f34-866b-6fc32c81d15c
status: test
description: This rule identifies Azure Key Vault key lifecycle events where a key is created, updated, imported, recovered, restored, backed up, deleted, or purged. Attackers may alter or remove keys to enable unauthorized access, deny service, or disrupt protected workloads, making these changes high-signal for credential access and impact. It relies on Azure Activity Log event entries matching specific MICROSOFT.KEYVAULT/VAULTS/KEYS operationName values.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-16
modified: 2022-08-23
tags:
  - attack.impact
  - attack.credential-access
  - attack.t1552
  - attack.t1552.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/UPDATE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/IMPORT/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/DELETE
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/BACKUP/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION
  condition: selection
falsepositives:
  - Key being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 80eeab92-0979-4152-942d-96749e11df40
    type: derived