Microsoft.Automation/automationAccounts/credentials/read

Azure

Microsoft.Automation/automationAccounts/credentials/read

service: Azure - Automation

tactics:

Credential Access Discovery

techniques:

T1552 T1526

tags:

Azure Automation

Event

Reads credential assets stored in an Azure Automation account, potentially exposing sensitive authentication data.

Security Context

Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.

Log Source

Azure Activity Log

Sample Event

Adversarial. Compromised user draco@fantasticlogs.cloud reads the OnPremDomainAdmin credential asset stored in the Automation account aa-occamy-automation. Automation credentials are stored encrypted but the management-plane read action returns the credential’s metadata (and depending on API version, the value when invoked from a runbook context). Even credential-name enumeration is high-value: knowing that OnPremDomainAdmin exists tells the attacker the org has on-prem AD bridged into Automation.

{
  "authorization": {
    "action": "Microsoft.Automation/automationAccounts/credentials/read",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/credentials/OnPremDomainAdmin"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud"
  },
  "correlationId": "90000000-0000-4000-8000-000010000100",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000010000101",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T20:58:14.7283194Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/credentials/OnPremDomainAdmin/events/90000000-0000-4000-8000-000010000101/ticks/638798220947283194",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000010000110",
  "operationName": {
    "value": "Microsoft.Automation/automationAccounts/credentials/read",
    "localizedValue": "Get an Azure Automation credential asset"
  },
  "resourceGroupName": "rg-occamy-pipeline",
  "resourceProviderName": {
    "value": "Microsoft.Automation",
    "localizedValue": "Microsoft.Automation"
  },
  "resourceType": {
    "value": "Microsoft.Automation/automationAccounts/credentials",
    "localizedValue": "Microsoft.Automation/automationAccounts/credentials"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/credentials/OnPremDomainAdmin",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "OK",
    "localizedValue": "OK (HTTP Status Code: 200)"
  },
  "submissionTimestamp": "2026-04-15T20:58:15.0184201Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "OK",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/credentials/OnPremDomainAdmin",
    "message": "Microsoft.Automation/automationAccounts/credentials/read",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": [],
  "httpRequest": {
    "clientRequestId": "90000000-0000-4000-8000-000010000111",
    "clientIpAddress": "203.0.113.66",
    "method": "GET",
    "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/credentials/OnPremDomainAdmin?api-version=2023-11-01"
  },
  "identity": null
}

MITRE ATT&CK Mapping

Tactics: Credential Access Discovery

Techniques:

T1552 — Unsecured Credentials — Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or applica...
T1526 — Cloud Service Discovery — An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can...

Microsoft.Automation/automationAccounts/credentials/read

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events