Microsoft.KeyVault/vaults/certificates/read
Azure
Microsoft.KeyVault/vaults/certificates/read
Event
Reads a certificate stored in an Azure Key Vault.
Security Context
- Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
- Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.
Log Source
Key Vault Diagnostic Logs (AuditEvent)
Sample Event
Adversarial. Following the access-policy modification (accessPolicies/write), draco@fantasticlogs.cloud reads the TLS certificate bowtruckle-prod-tls-cert from kv-bowtruckle-prod. The data-plane request hits the vault directly at kv-bowtruckle-prod.vault.azure.net. The request is authenticated as Draco’s user identity via OAuth2 bearer token (no MSI / SP).
{ "time": "2026-04-15T17:48:21.5421047Z", "resourceId": "/SUBSCRIPTIONS/20000000-0000-4000-8000-000000000001/RESOURCEGROUPS/RG-BOWTRUCKLE-VAULT/PROVIDERS/MICROSOFT.KEYVAULT/VAULTS/KV-BOWTRUCKLE-PROD", "operationName": "CertificateGet", "operationVersion": "7.4", "category": "AuditEvent", "resultType": "Success", "resultSignature": "OK", "resultDescription": "", "durationMs": "47", "callerIpAddress": "203.0.113.66", "correlationId": "90000000-0000-4000-8000-000100000011", "identity": { "claim": { "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation" } }, "properties": { "id": "https://kv-bowtruckle-prod.vault.azure.net/certificates/bowtruckle-prod-tls-cert/a1b2c3d4e5f60000111100001010011010", "clientInfo": "python/3.11.6 (Linux-5.15.0-1052-aws-x86_64-with-glibc2.35) AZURECLI/2.56.0 (DEB)", "requestUri": "https://kv-bowtruckle-prod.vault.azure.net/certificates/bowtruckle-prod-tls-cert/a1b2c3d4e5f60000111100001010011010?api-version=7.4", "httpStatusCode": 200 }, "tenantId": "10000000-0000-4000-8000-000000000001"}MITRE ATT&CK Mapping
Tactics: Credential Access
Techniques:
- T1555.006 — Cloud Secrets Management Stores — Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.