Azure Key Vault Diagnostic Logs

Location

Description

Key Vault diagnostic logs capturing every operation on secrets, keys, and certificates including Get, Set, Delete, Backup, Restore, and access policy changes with caller identity, IP address, and result status.

Forensic Value

Key Vault logs prove which secrets and keys were actually read during a breach, not just which were accessible by permissions. SecretGet operations with timestamps identify exactly when an attacker retrieved database connection strings, API keys, or certificates. Comparing actual access against RBAC permissions distinguishes between potential and confirmed data exposure. Access policy modifications reveal if the attacker granted themselves additional Key Vault permissions.

Tools Required

Collection Commands

AzureDiagnostics | where ResourceProvider == "MICROSOFT.KEYVAULT" | where TimeGenerated > ago(30d) | where OperationName == "SecretGet" or OperationName == "SecretSet" | project TimeGenerated, CallerIPAddress, identity_claim_upn_s, OperationName, id_s, ResultType

az monitor diagnostic-settings list --resource $(az keyvault show --name <vault-name> --query id -o tsv) --output json > kv_diagnostic_settings.json

Get-AzKeyVaultSecret -VaultName <vault-name> | ForEach-Object { Get-AzKeyVaultSecret -VaultName <vault-name> -Name $_.Name -IncludeVersions | Select-Object Name, Version, Created, Updated } | Export-Csv kv_secrets_inventory.csv -NoTypeInformation

MITRE ATT&CK Techniques