Azure Key Vault Write, Delete, Deployment, and Access Policy Changes

Alerts on Azure Activity Log Key Vault management operations: write, delete, deploy actions, or access policy changes.

FreeUnreviewedSigmamediumv1

azure-key-vault-write-delete-deployment-and-access-policy-changes-459a2970

title: Azure Key Vault Write, Delete, Deployment, and Access Policy Changes
id: ae220ad4-d5fa-4bf2-b7fa-f718587a8a8d
status: test
description: This rule flags Azure Activity Logs events where a Key Vault is modified via write, delete, deployment actions, or access policy updates. Attackers may target Key Vault configuration to disrupt secret protection or alter access to credentials. It relies on Activity Log telemetry that captures Key Vault operationName values corresponding to these management actions.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-16
modified: 2022-08-23
tags:
  - attack.impact
  - attack.credential-access
  - attack.t1552
  - attack.t1552.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.KEYVAULT/VAULTS/WRITE
      - MICROSOFT.KEYVAULT/VAULTS/DELETE
      - MICROSOFT.KEYVAULT/VAULTS/DEPLOY/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/ACCESSPOLICIES/WRITE
  condition: selection
falsepositives:
  - Key Vault being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Key Vault modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 459a2970-bb84-4e6a-a32e-ff0fbd99448d
    type: derived

What it detects

This rule flags Azure Activity Logs events where a Key Vault is modified via write, delete, deployment actions, or access policy updates. Attackers may target Key Vault configuration to disrupt secret protection or alter access to credentials. It relies on Activity Log telemetry that captures Key Vault operationName values corresponding to these management actions.

Known false positives

Key Vault being modified or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Key Vault modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.