Risky Sign In Followedby Key Vault Activity

Query

EntraIdSignInEvents
| where RiskLevelDuringSignIn in (10, 50, 100)
| project SignInTime = Timestamp, IPAddress, UserAgent, AccountUpn, UniqueTokenId, ErrorCode
| join kind=inner (
    CloudKeyVaultEvents
    | where AccountType == "user"
    | extend UniqueTokenIdentifier = tostring(AdditionalFields.UniqueTokenIdentifier)
    | project KeyVaultEventTime = Timestamp, UniqueTokenIdentifier, AzureResourceId, ActivityName
) on $left.UniqueTokenId == $right.UniqueTokenIdentifier
| where KeyVaultEventTime >= SignInTime

About this query

Risky Sign-in Followed by Key Vault Activity

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1555.006	Credentials from Password Stores: Cloud Secrets Management Stores	https://attack.mitre.org/techniques/T1555/006/

Description

Identifies user sign-ins with a RiskLevelDuringSignIn value of 10 (low), 50 (medium), or 100 (high) that are followed by Azure Key Vault activity associated with the sign-in's unique token identifier. Review the account, source IP address, user agent, sign-in error code, accessed vault, and activity to determine whether the activity is authorized.

Risk

A compromised identity or session may be used to enumerate Key Vault objects or retrieve secrets, keys, or certificates. Successful retrieval can expose credentials and enable access to additional resources. Investigate both successful and failed sign-ins, and verify that the subsequent Key Vault activity is expected for the user and source IP.

References

https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/

Defender XDR

Explanation

This query is designed to identify potentially risky user sign-ins that are followed by activity in Azure Key Vault. Here's a simplified breakdown:

Purpose: The query aims to detect instances where a user signs in with a certain risk level and then performs actions in Azure Key Vault. This could indicate suspicious behavior, such as an unauthorized user accessing sensitive information.
Risk Levels: It focuses on sign-ins with risk levels of low (10), medium (50), or high (100).
Data Sources:
- EntraIdSignInEvents: This part of the query looks at user sign-in events, capturing details like the time of sign-in, IP address, user agent, account name, unique token ID, and any error codes.
- CloudKeyVaultEvents: This part examines activities in Azure Key Vault, specifically those performed by users. It captures the time of the event, the unique token identifier, the Azure resource ID, and the type of activity performed.
Logic: The query joins these two data sources based on the unique token identifier, ensuring that the Key Vault activity is associated with the specific sign-in event.
Time Constraint: It only considers Key Vault activities that occur after the sign-in event, ensuring a logical sequence of actions.
Investigation: The results can help security teams investigate whether the Key Vault activities following a risky sign-in are legitimate or potentially malicious. This involves checking the account details, source IP, and the nature of the Key Vault activity.

Overall, the query helps in monitoring and investigating potential security incidents involving Azure Key Vault access following risky sign-ins.