Monitoring Azure Key Vault Unauthorized Enumeration and Secret Access with KQL

Azure Key Vault stores critical infrastructure credentials, database connection strings, and certificates. Attackers who gain identity access in an Azure environment quickly probe Key Vaults to stage lateral movement across internal APIs and databases.

To catch credential harvesting, monitor AzureDiagnostics for high-volume SecretGet and unauthorized 403 Forbidden operations.

Log Source Setup

• Enable Diagnostic Settings on critical Key Vaults and stream AuditEvent to Microsoft Sentinel (AzureDiagnostics).

Key Vault Hunting Query

// Detect Bulk Secret Access and Unauthorized Access Probing in Azure Key Vault
let timeRange = 24h;
AzureDiagnostics
| where TimeGenerated >= ago(timeRange)
| where ResourceProvider =~ "MICROSOFT.KEYVAULT"
| where OperationName in~ ("SecretGet", "SecretList", "KeyGet", "CertificateGet")
| extend CallerIP = CallerIPAddress,
         Identity = identity_claim_upn_s,
         AppId = identity_claim_appid_s,
         VaultName = Resource
| summarize 
    TotalOperations = count(),
    UniqueSecretsAccessed = dcount(id_s),
    OperationsList = make_set(OperationName, 10),
    Http403Count = countif(httpStatusCode_d == 403),
    Http200Count = countif(httpStatusCode_d == 200)
    by Identity, AppId, CallerIP, VaultName, bin(TimeGenerated, 1h)
| where Http403Count >= 3 or UniqueSecretsAccessed >= 5
| project TimeGenerated, VaultName, Identity, AppId, CallerIP, Http403Count, Http200Count, UniqueSecretsAccessed, OperationsList
| order by Http403Count desc, UniqueSecretsAccessed desc

Indicators of Abuse

• Spike in 403 Forbidden: Adversaries script credential scans across multiple vaults without knowing exact RBAC or Access Policy boundaries.
• High dcount(id_s): Normal enterprise applications query 1 or 2 specific secrets at startup. Querying 10+ distinct secrets across a single hour indicates harvesting.

MITRE ATT&CK Mapping

• Tactic: Credential Access (TA0006), Discovery (TA0007)
• Technique: Unsecured Credentials (T1552), Data from Cloud Storage Object (T1530)