AZT604.3 - Azure Key Vault Dumping: Azure Key Vault Key Dump#
By accessing an Azure Key Vault, an adversary may dump any or all public keys. Note that Private keys cannot be retrieved.
Resource
Azure Key Vault
Actions
- Microsoft.KeyVault/vaults/keys/read
Examples
Detections
Detection Details#
By default, logging is not enabled on Key Vaults, meaning whenever a secret/key/certificate is accessed, it will not be logged unless Key Vault logging is turned on.
Logs#
| Data Source | Operation Name | Action | Log Provider |
|---|---|---|---|
| Resource | KeyGet | N/A | AzureDiagnostics |
Queries#
| Platform | Query |
|---|---|
| Log Analytics | AzureDiagnostics | where ResourceProvider == 'MICROSOFT.KEYVAULT' and OperationName == 'KeyGet' |