Azure Key Vault Mass Secret Retrieval By Single Actor

Query

CloudKeyVaultEvents
| where TimeGenerated >= ago(10m)
| where ActivityName in~ ("SecretGet", "CertificateGet", "KeyUnwrap")
| where tostring(HttpStatusCode) == "200" or ResultSignature =~ "OK"
| extend ActorId = case(
    isnotempty(AccountObjectId), AccountObjectId,
    isnotempty(AccountApplicationId), AccountApplicationId,
    AccountUpn
)
| extend ResourcePath = tostring(parse_url(RequestUri).Path)
| where isnotempty(ActorId) and isnotempty(ResourcePath)
| summarize Calls = count(),
            DistinctResources = dcount(ResourcePath),
            Operations = make_set(ActivityName),
            UserAgents = make_set(UserAgentHeader)
    by bin(TimeGenerated, 10m), VaultName, ActorId, IPAddress
| where Calls >= 20 and DistinctResources >= 5

About this query

Explanation

This query is designed to monitor Azure Key Vault activities to detect potential security threats. It specifically looks for instances where a single user or identity accesses a large number of secrets, certificates, or keys in a short period, which could indicate credential harvesting after a security breach.

Here's a simplified breakdown of what the query does:

Time Frame: It examines events from the last 10 minutes.
Activity Type: It focuses on successful read operations, specifically "SecretGet", "CertificateGet", and "KeyUnwrap".
Actor Identification: It identifies the actor (user or application) by checking the account object ID, application ID, or user principal name (UPN).
Resource Tracking: It tracks the resources accessed by parsing the request URI to count distinct resources accessed by each actor.
Data Aggregation: The query summarizes the data into 10-minute intervals for each vault, actor, and source IP address.
Alert Criteria: An alert is triggered if an actor makes at least 20 calls and accesses at least 5 different resources within the 10-minute window.
Purpose: The query aims to identify unusual behavior that might suggest a compromised identity is being used to access a wide range of secrets, which is atypical for legitimate applications.
Customization: The thresholds for the number of calls and distinct resources can be adjusted based on the specific environment to reduce false positives, such as those caused by deployment pipelines or backup tools.

Overall, this query helps in identifying potential security incidents by flagging unusual access patterns to Azure Key Vault resources.