Microsoft.KeyVault/vaults/keys/read
Azure
Microsoft.KeyVault/vaults/keys/read
Event
Reads a cryptographic key from an Azure Key Vault.
Security Context
- Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
- Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.
Log Source
Key Vault Diagnostic Logs (AuditEvent)
Sample Event
Adversarial. After modifying access policies on kv-bowtruckle-prod, draco@fantasticlogs.cloud reads the data-encryption key bowtruckle-data-encryption-key from the vault. KeyGet returns the JsonWebKey (kty/n/e/etc.) — for a non-HSM, non-extractable key the private material is not returned, but for a software-protected exportable key it is. Either way, this is a high-signal credential-access event.
{ "time": "2026-04-15T17:50:33.2148201Z", "resourceId": "/SUBSCRIPTIONS/20000000-0000-4000-8000-000000000001/RESOURCEGROUPS/RG-BOWTRUCKLE-VAULT/PROVIDERS/MICROSOFT.KEYVAULT/VAULTS/KV-BOWTRUCKLE-PROD", "operationName": "KeyGet", "operationVersion": "7.4", "category": "AuditEvent", "resultType": "Success", "resultSignature": "OK", "resultDescription": "", "durationMs": "32", "callerIpAddress": "203.0.113.66", "correlationId": "90000000-0000-4000-8000-000100000111", "identity": { "claim": { "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation" } }, "properties": { "id": "https://kv-bowtruckle-prod.vault.azure.net/keys/bowtruckle-data-encryption-key/0a1b2c3d4e5f60001010011010aabbcc", "clientInfo": "python/3.11.6 (Linux-5.15.0-1052-aws-x86_64-with-glibc2.35) AZURECLI/2.56.0 (DEB)", "requestUri": "https://kv-bowtruckle-prod.vault.azure.net/keys/bowtruckle-data-encryption-key/0a1b2c3d4e5f60001010011010aabbcc?api-version=7.4", "httpStatusCode": 200 }, "tenantId": "10000000-0000-4000-8000-000000000001"}MITRE ATT&CK Mapping
Tactics: Credential Access
Techniques:
- T1555.006 — Cloud Secrets Management Stores — Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.