HUNT 09 New SP Key Vault Access

Query

// Hunt     : Hunt - Service Principals Accessing Key Vault for the First Time Within 7 Days
// Tactics  : CredentialAccess
// MITRE    : T1552.001
// Purpose  : Surfaces identities that accessed a Key Vault for the first time in the last 7 days. Compromised service principals and attacker-created SPs often probe Key Vaults for secrets/certs after initial access. Investigate any SP not expected to require KV access.
//==========================================================================================

let AllKVAccess = AzureActivity
    | where TimeGenerated > ago(90d)
    | where OperationNameValue startswith "MICROSOFT.KEYVAULT/VAULTS/"
    | where ActivityStatusValue =~ "Success"
    | extend VaultPath = tostring(strcat(SubscriptionId, "/", ResourceGroup, "/", tostring(split(ResourceId, "/")[8])))
    | summarize FirstAccessEver = min(TimeGenerated) by Caller, VaultPath;
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue startswith "MICROSOFT.KEYVAULT/VAULTS/"
| where ActivityStatusValue =~ "Success"
| extend VaultPath = tostring(strcat(SubscriptionId, "/", ResourceGroup, "/", tostring(split(ResourceId, "/")[8])))
// FIX: join on BOTH Caller and VaultPath. The previous version joined on Caller only, so a
// caller newly accessing vault A would also surface all of their long-standing vault B access.
| join kind=inner AllKVAccess on Caller, VaultPath
| where FirstAccessEver > ago(7d)
| project TimeGenerated, Caller, Operation = OperationNameValue, ResourceId, CallerIpAddress, SubscriptionId, ResourceGroup, VaultPath, FirstAccessEver
| order by FirstAccessEver desc

Explanation

This query is designed to identify service principals (SPs) that have accessed an Azure Key Vault for the first time within the last 7 days. Here's a simple breakdown of what the query does:

Collect Historical Access Data:
- It first gathers all successful access attempts to any Key Vault over the past 90 days.
- For each access attempt, it records the earliest time a particular service principal accessed a specific Key Vault.
Identify Recent First-Time Access:
- It then focuses on access attempts made in the last 7 days.
- It checks if these recent access attempts are the first time the service principal has accessed that specific Key Vault.
Filter and Present Results:
- The query filters out any access that is not a first-time access within the last 7 days.
- It presents details such as the time of access, the service principal (Caller), operation details, resource information, and the IP address from which the access was made.
Purpose:
- The goal is to surface potentially suspicious activities where a service principal, which might be compromised or maliciously created, is accessing Key Vaults unexpectedly. This can help in identifying unauthorized attempts to access sensitive information like secrets or certificates stored in Key Vaults.

By focusing on first-time access within a short timeframe, this query helps security teams quickly identify and investigate unusual or unauthorized access patterns to Azure Key Vaults.