Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action
Azure
Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action
Event
Lists the access keys for an Azure Service Bus namespace authorization rule, exposing connection strings for messaging.
Security Context
- Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
- Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.
Log Source
Azure Activity Log
Sample Event
Adversarial. draco@fantasticlogs.cloud lists the keys for the RootManageSharedAccessKey rule on the production Service Bus namespace sb-occamy-events, retrieving the namespace-level connection string. Possessing the connection string lets the attacker connect to every queue/topic in the namespace from anywhere on the internet, bypassing Service Bus’s network restrictions and Entra ID auth.
{ "authorization": { "action": "Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action", "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.ServiceBus/namespaces/sb-occamy-events/AuthorizationRules/RootManageSharedAccessKey" }, "caller": "draco@fantasticlogs.cloud", "channels": "Operation", "claims": { "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "ipaddr": "203.0.113.66", "name": "Draco Malfoy", "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "puid": "1003200000000666", "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814", "uti": "sbLk219ExampleUtid01", "ver": "1.0" }, "correlationId": "90000000-0000-4000-8000-000100001101", "description": "", "eventDataId": "90000000-0000-4000-8000-000100001110", "eventName": { "value": "EndRequest", "localizedValue": "End request" }, "category": { "value": "Administrative", "localizedValue": "Administrative" }, "eventTimestamp": "2026-04-15T17:54:21.1428207Z", "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.ServiceBus/namespaces/sb-occamy-events/AuthorizationRules/RootManageSharedAccessKey/events/90000000-0000-4000-8000-000100001110/ticks/638798222611428207", "level": "Informational", "operationId": "90000000-0000-4000-8000-000100110011", "operationName": { "value": "Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action", "localizedValue": "List Service Bus Namespace Keys" }, "resourceGroupName": "rg-occamy-pipeline", "resourceProviderName": { "value": "Microsoft.ServiceBus", "localizedValue": "Microsoft.ServiceBus" }, "resourceType": { "value": "Microsoft.ServiceBus/namespaces/AuthorizationRules", "localizedValue": "Microsoft.ServiceBus/namespaces/AuthorizationRules" }, "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.ServiceBus/namespaces/sb-occamy-events/AuthorizationRules/RootManageSharedAccessKey", "status": { "value": "Succeeded", "localizedValue": "Succeeded" }, "subStatus": { "value": "OK", "localizedValue": "OK (HTTP Status Code: 200)" }, "submissionTimestamp": "2026-04-15T17:54:21.6029108Z", "subscriptionId": "20000000-0000-4000-8000-000000000001", "tenantId": "10000000-0000-4000-8000-000000000001", "properties": { "statusCode": "OK", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.ServiceBus/namespaces/sb-occamy-events/AuthorizationRules/RootManageSharedAccessKey/listKeys", "message": "Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action", "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001" }, "relatedEvents": []}MITRE ATT&CK Mapping
Tactics: Credential Access Discovery
Techniques:
- T1552 — Unsecured Credentials — Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or applica...
- T1526 — Cloud Service Discovery — An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can...