Azure Key Vault Secrets Modified or Deleted via Activity Logs

Flags Azure Key Vault secret write, update, delete, purge, and restore operations in Activity Logs.

FreeUnreviewedSigmamediumv1

azure-key-vault-secrets-modified-or-deleted-via-activity-logs-b831353c

title: Azure Key Vault Secrets Modified or Deleted via Activity Logs
id: 03876359-aa93-43f8-94fd-a6c72195ae32
status: test
description: This rule identifies Azure Activity Log events where Key Vault secrets are modified, deleted, backed up, purged, updated, recovered, restored, or set. Such actions can indicate credential access or impact, since changing or removing secrets may disrupt applications or enable unauthorized use. It relies on Azure Activity Logs matching specific Key Vault secret-related operation names.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-16
modified: 2022-08-23
tags:
  - attack.impact
  - attack.credential-access
  - attack.t1552
  - attack.t1552.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.KEYVAULT/VAULTS/SECRETS/WRITE
      - MICROSOFT.KEYVAULT/VAULTS/SECRETS/DELETE
      - MICROSOFT.KEYVAULT/VAULTS/SECRETS/BACKUP/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/SECRETS/PURGE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/SECRETS/UPDATE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/SECRETS/SETSECRET/ACTION
  condition: selection
falsepositives:
  - Secrets being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: b831353c-1971-477b-abb6-2828edc3bca1
    type: derived

What it detects

This rule identifies Azure Activity Log events where Key Vault secrets are modified, deleted, backed up, purged, updated, recovered, restored, or set. Such actions can indicate credential access or impact, since changing or removing secrets may disrupt applications or enable unauthorized use. It relies on Azure Activity Logs matching specific Key Vault secret-related operation names.

Known false positives

Secrets being modified or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.