Key Vault Secret Access From New IP Address Per Identity

Query

let DetectionEnd = now();
let DetectionStart = DetectionEnd - 1h;
let LookbackStart = DetectionEnd - 14d;
let Events = materialize(
    CloudKeyVaultEvents
    | where TimeGenerated between (LookbackStart .. DetectionEnd)
    | where ActivityName in~ ("SecretGet", "KeyUnwrap", "CertificateGet")
    | where tostring(HttpStatusCode) == "200"
        or ResultSignature =~ "OK"
    | extend ActorId = case(
        isnotempty(AccountObjectId),
            strcat("object:", tolower(AccountObjectId)),
        isnotempty(AccountApplicationId),
            strcat("app:", tolower(AccountApplicationId)),
        isnotempty(AccountUpn),
            strcat("upn:", tolower(AccountUpn)),
        ""
    )
    | extend ActorTenant = tolower(AccountTenantId),
             VaultId = tolower(AzureResourceId),
             UserAgent = trim(@"\s+", tostring(UserAgentHeader))
    | where isnotempty(ActorId)
        and isnotempty(ActorTenant)
        and isnotempty(VaultId)
);
let Baseline = Events
    | where TimeGenerated < DetectionStart;
let KnownActors = Baseline
    | distinct ActorTenant, ActorId, VaultId;
let KnownIPs = Baseline
    | where isnotempty(IPAddress)
    | distinct ActorTenant, ActorId, VaultId, IPAddress;
let KnownUserAgents = Baseline
    | where isnotempty(UserAgent)
    | distinct ActorTenant, ActorId, VaultId, UserAgent;
Events
| where TimeGenerated >= DetectionStart
| where isnotempty(IPAddress) and isnotempty(UserAgent)
| join kind=inner KnownActors
    on ActorTenant, ActorId, VaultId
| join kind=leftanti KnownIPs
    on ActorTenant, ActorId, VaultId, IPAddress
| join kind=leftanti KnownUserAgents
    on ActorTenant, ActorId, VaultId, UserAgent
| summarize
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    Calls = count(),
    Operations = make_set(ActivityName, 10),
    RequestUris = make_set(RequestUri, 50),
    AccountUpns = make_set(AccountUpn, 10)
    by ActorTenant, ActorId, VaultId, VaultName,
       IPAddress, UserAgent

About this query

Explanation

This query is designed to detect unusual access patterns to Azure Key Vault secrets, keys, and certificates. It specifically looks for instances where an identity (like a user or application) accesses these sensitive objects from an IP address they haven't used before with the same vault. Here's a simplified breakdown of how it works:

Baseline Creation: The query first establishes a 14-day baseline of normal access patterns. It records successful access attempts (like reading secrets or unwrapping keys) by different identities, noting the IP addresses they use.
Current Activity Monitoring: It then examines the last hour of access events to see if there are any new combinations of identity and IP address that weren't seen in the baseline period.
Comparison: By comparing the current activity with the baseline, the query identifies any new IP addresses being used by an identity to access the vault. This could indicate suspicious activity, such as stolen credentials or compromised accounts.
Output: The query outputs details of these unusual access attempts, including the identity, account type, vault, requested URI, and user agent. This information helps in quickly assessing whether the activity is legitimate or potentially malicious.
Considerations: The query acknowledges that there might be false positives due to legitimate changes, like new identities or scaling operations that use new IP addresses. These can be managed by maintaining an allowlist of known IP ranges or excluding very new identities from the analysis.

Overall, this query helps in identifying potential security threats by flagging unexpected access patterns to sensitive Azure Key Vault resources.