Home
Mapping Frameworks
Azure Home
Azure Defender for Key Vault

Azure azure_defender_for_key_vault Mappings

Azure Defender detects unusual and potentially harmful attempts to access or exploit Key Vault accounts. When anomalous activities occur, Azure Defender shows alerts and optionally sends them via email to relevant members of your organization. These alerts include the details of the suspicious activity and recommendations on how to investigate and remediate threats.

Mappings

Capability ID	Capability Description	Category	Value	ATT&CK ID	ATT&CK Name	Notes
azure_defender_for_key_vault	Azure Defender for Key Vault	detect	minimal	T1580	Cloud Infrastructure Discovery	Comments This control may alert on suspicious access of key vaults, including suspicious listing of key vault contents. This control does not alert on discovery of other cloud services, such as VMs, snapshots, cloud storage and therefore has minimal coverage. Suspicious activity based on patterns of access from certain users and applications allows for managing false positive rates. References https://docs.microsoft.com/en-us/azure/security-center/defender-for-key-vault-introduction https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-azurekv
azure_defender_for_key_vault	Azure Defender for Key Vault	detect	partial	T1555	Credentials from Password Stores	Comments This control may detect suspicious secret access from Azure key vaults. This does not apply to any sub-techniques under T1555 - Credentials from Password Stores but Azure Key Vault can be treated as a store for passwords, keys, and certificates. The coverage of this control could be deemed high for cloud credential and secret storage within Key Vault but is not applicable to traditional password stores, such as password managers, keychain, or web browsers. References https://docs.microsoft.com/en-us/azure/security-center/defender-for-key-vault-introduction https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-azurekv