HUNT 17 Key Vault Bulk Read
Query
// Hunt : Hunt - KeyVault Secret or Key Bulk Read (potential dump)
// Tactics : CredentialAccess, Collection
// MITRE : T1552.001, T1555
// Purpose : Surfaces identities reading/listing 25+ Key Vault secrets, keys, or certificates
// within a single hour — the signature of a credential-dump sweep after a vault is
// compromised. Tune the ReadThreshold to your busiest legitimate consumer.
//==========================================================================================
let Window = 7d;
let ReadThreshold = 25;
AzureActivity
| where TimeGenerated > ago(Window)
| where OperationNameValue has_any (
"VAULTS/SECRETS/READ", "VAULTS/KEYS/READ", "VAULTS/CERTIFICATES/READ",
"VAULTS/SECRETS/GETSECRET/ACTION", "VAULTS/SECRETS/LIST")
| where ActivityStatusValue =~ "Success"
| summarize
ReadCount = count(),
DistinctObjects = dcount(_ResourceId),
Vaults = make_set(tostring(split(_ResourceId, "/")[8]), 20),
Operations = make_set(OperationNameValue, 5)
by Caller, CallerIpAddress, bin(TimeGenerated, 1h)
| where ReadCount >= ReadThreshold
| order by ReadCount descExplanation
This query is designed to detect potential unauthorized access to Azure Key Vaults by identifying instances where a user or identity reads or lists a large number of secrets, keys, or certificates within a short time frame. Here's a breakdown of what the query does:
-
Time Frame: It looks at Azure activity logs from the past 7 days (
Window = 7d). -
Read Threshold: It focuses on cases where 25 or more read operations occur within a single hour (
ReadThreshold = 25). -
Activity Filtering: The query filters for successful operations related to reading secrets, keys, or certificates from Azure Key Vaults.
-
Data Aggregation: For each user (identified by
Caller) and their IP address (CallerIpAddress), it counts the number of read operations (ReadCount) and identifies the distinct vaults accessed (DistinctObjects). It also collects the names of the vaults and the types of operations performed. -
Suspicious Activity Detection: It highlights cases where the number of read operations meets or exceeds the threshold, suggesting potential credential dumping activity.
-
Output: The results are ordered by the number of read operations in descending order, helping to quickly identify the most suspicious activities.
In simple terms, this query helps security teams spot unusual and potentially malicious activity involving bulk access to sensitive information stored in Azure Key Vaults.
