KQL Search

Query Details

Suspicious Key Vault Enumerationor Reads

Query

// Adjust thresholds based on your own environment
let KeyVaultThreshold = 3;
let SecretReadActivitiesThreshold = 1;
let EnumerationActivitiesThreshold = 1;
let TimeFrame = 3h;
let EnumerationActivities = dynamic([
    "SecretList",
    "SecretListVersions",
    "SecretListDeleted",
    "KeyList",
    "KeyListVersions",
    "KeyListDeleted",
    "CertificateList",
    "CertificateListVersions",
    "CertificateListDeleted"
]);
let ReadActivities = dynamic([
    "SecretGet",
    "KeyGet",
    "CertificateGet"
]);
CloudKeyVaultEvents
| where ActivityName in~ (EnumerationActivities) or ActivityName in~ (ReadActivities)
| summarize Total = count(), UniqueKeyVaults = dcount(AzureResourceId), TotalEnumerationActivities = countif(ActivityName in~ (EnumerationActivities)), TotalReadActivities = countif(ActivityName in~ (ReadActivities)) by AccountObjectId, AccountType, bin(TimeGenerated, TimeFrame)
| where UniqueKeyVaults >= KeyVaultThreshold and TotalEnumerationActivities >= EnumerationActivitiesThreshold and TotalReadActivities >= SecretReadActivitiesThreshold

About this query

Explanation

This query is designed to detect potentially suspicious activities related to Azure Key Vaults, which are used to store sensitive information like secrets, keys, and certificates. Here's a simplified breakdown of what the query does:

  1. Purpose: It aims to identify unusual patterns in how accounts interact with Azure Key Vaults, specifically focusing on enumeration (listing) and reading (retrieving) activities.

  2. Activities Monitored:

    • Enumeration Activities: Actions like listing secrets, keys, certificates, their versions, and deleted objects.
    • Read Activities: Actions like retrieving secrets, keys, and certificates.

  3. Detection Criteria:

    • The query looks for accounts that interact with a high number of different Key Vaults (more than a set threshold).
    • It also checks if the account performs a significant number of enumeration and read activities (each exceeding their respective thresholds).

  4. Time Frame: The activities are analyzed over a specified time period (3 hours in this case).

  5. Output: The query summarizes the total number of activities, the number of unique Key Vaults accessed, and the counts of enumeration and read activities for each account. It filters out results that don't meet the specified thresholds, focusing on potentially suspicious behavior.

  6. Risk: High-volume access or access to multiple vaults could indicate an attempt to harvest credentials or other sensitive data.

  7. Customization: The thresholds for what constitutes suspicious activity can be adjusted based on what is considered normal for the specific environment.

This query helps security teams monitor for and investigate unusual access patterns to Azure Key Vaults, which could be indicative of malicious activity.