Microsoft.Web/sites/host/listKeys/action

Azure

Microsoft.Web/sites/host/listKeys/action

service: Azure - Web

tactics:

Credential Access Discovery

techniques:

T1552 T1526

tags:

Azure Web

Event

Lists the host keys for an Azure App Service or Azure Functions app, exposing function-level and master access keys.

Security Context

Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.

Log Source

Azure Activity Log

Sample Event

Adversarial. draco@fantasticlogs.cloud calls listHostKeys on the production Azure Functions app func-occamy-log-processor. With the returned master key, Draco can invoke any function in the app from anywhere on the internet (via ?code=<masterKey> query parameter), bypassing the Function’s authLevel restriction and any Entra-ID-based gating.

{
  "authorization": {
    "action": "Microsoft.Web/sites/host/listKeys/action",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Web/sites/func-occamy-log-processor/host/default"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "puid": "1003200000000666",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud",
    "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814",
    "uti": "fnLk227ExampleUtid01",
    "ver": "1.0"
  },
  "correlationId": "90000000-0000-4000-8000-000100011011",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000100011100",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T18:01:48.7421022Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Web/sites/func-occamy-log-processor/host/default/events/90000000-0000-4000-8000-000100011100/ticks/638798227087421022",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000100111011",
  "operationName": {
    "value": "Microsoft.Web/sites/host/listKeys/action",
    "localizedValue": "List Web App Host Keys"
  },
  "resourceGroupName": "rg-occamy-pipeline",
  "resourceProviderName": {
    "value": "Microsoft.Web",
    "localizedValue": "Microsoft.Web"
  },
  "resourceType": {
    "value": "Microsoft.Web/sites/host",
    "localizedValue": "Microsoft.Web/sites/host"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Web/sites/func-occamy-log-processor/host/default",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "OK",
    "localizedValue": "OK (HTTP Status Code: 200)"
  },
  "submissionTimestamp": "2026-04-15T18:01:49.3052812Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "OK",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Web/sites/func-occamy-log-processor/host/default/listKeys",
    "message": "Microsoft.Web/sites/host/listKeys/action",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": []
}

MITRE ATT&CK Mapping

Tactics: Credential Access Discovery

Techniques:

T1552 — Unsecured Credentials — Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or applica...
T1526 — Cloud Service Discovery — An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can...

Microsoft.Web/sites/host/listKeys/action

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events