Skip to content

AZT704.1 - Soft-Delete Recovery: Key Vault#

An adversary may recover a key vault object found in a 'soft deletion' state.

Resource

Azure Key Vault

Actions

  • Microsoft.KeyVault/vaults/*/restore

  • Microsoft.KeyVault/locations/deletedVaults/read

Detections

Logs#

Data Source Operation Name Action Log Location
Resource TBD TBD Log Analytics