key modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

t1552
t1552.001
azure
sigma

Techniques

t1552
t1552.001

Sample rules

Azure Keyvault Key Modified or Deleted

source: sigma
technicques:
- t1552
- t1552.001

Description

Identifies when a Keyvault Key is modified or deleted in Azure.

Detection logic

condition: selection
selection:
  operationName:
  - MICROSOFT.KEYVAULT/VAULTS/KEYS/UPDATE/ACTION
  - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE
  - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE/ACTION
  - MICROSOFT.KEYVAULT/VAULTS/KEYS/IMPORT/ACTION
  - MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION
  - MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION
  - MICROSOFT.KEYVAULT/VAULTS/KEYS/DELETE
  - MICROSOFT.KEYVAULT/VAULTS/KEYS/BACKUP/ACTION
  - MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION