Microsoft.Batch/batchAccounts/listKeys/action

Azure

Microsoft.Batch/batchAccounts/listKeys/action

service: Azure - Batch

tactics:

Credential Access Discovery

techniques:

T1552 T1526

tags:

Azure Batch

Event

Lists the access keys for an Azure Batch account, exposing credentials used to authenticate Batch API calls.

Security Context

Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.

Log Source

Azure Activity Log

Sample Event

Adversarial. Compromised user draco@fantasticlogs.cloud calls listKeys on the production Batch account batchoccamy to harvest the primary and secondary shared-key credentials. Once exfiltrated, these grant Draco data-plane access to the Batch account (submit jobs, read pool credentials, inspect application packages) without needing further Azure auth — durable until rotation.

{
  "authorization": {
    "action": "Microsoft.Batch/batchAccounts/listKeys/action",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Batch/batchAccounts/batchoccamy"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud"
  },
  "correlationId": "90000000-0000-4000-8000-000010011000",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000010011001",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T21:31:18.5172938Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Batch/batchAccounts/batchoccamy/events/90000000-0000-4000-8000-000010011001/ticks/638798240785172938",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000010011010",
  "operationName": {
    "value": "Microsoft.Batch/batchAccounts/listKeys/action",
    "localizedValue": "List Batch account keys"
  },
  "resourceGroupName": "rg-occamy-pipeline",
  "resourceProviderName": {
    "value": "Microsoft.Batch",
    "localizedValue": "Microsoft Batch"
  },
  "resourceType": {
    "value": "Microsoft.Batch/batchAccounts",
    "localizedValue": "Microsoft.Batch/batchAccounts"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Batch/batchAccounts/batchoccamy",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "OK",
    "localizedValue": "OK (HTTP Status Code: 200)"
  },
  "submissionTimestamp": "2026-04-15T21:31:19.0218728Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "OK",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Batch/batchAccounts/batchoccamy",
    "message": "Microsoft.Batch/batchAccounts/listKeys/action",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": [],
  "httpRequest": {
    "clientRequestId": "90000000-0000-4000-8000-000010011011",
    "clientIpAddress": "203.0.113.66",
    "method": "POST",
    "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Batch/batchAccounts/batchoccamy/listKeys?api-version=2024-07-01"
  },
  "identity": null
}

MITRE ATT&CK Mapping

Tactics: Credential Access Discovery

Techniques:

T1552 — Unsecured Credentials — Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or applica...
T1526 — Cloud Service Discovery — An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can...

Microsoft.Batch/batchAccounts/listKeys/action

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events