Panther low experimental python

Azure Key Vault Permanently Purged

Detects when an entire Azure Key Vault is permanently purged. Purging a Key Vault is an irreversible operation that permanently destroys all keys, secrets, and certificates stored within it. This is more destructive than deleting a vault and may indicate ransomware activity or malicious data destruction.

View Source

Detection Logic

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

KEYVAULT_PURGE = "MICROSOFT.KEYVAULT/LOCATIONS/DELETEDVAULTS/PURGE/ACTION"


def rule(event):
    return event.get("operationName", "").upper() == KEYVAULT_PURGE and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "")
    keyvault = extract_resource_name_from_id(
        resource_id, "deletedVaults", default="<UNKNOWN_KEYVAULT>"
    )
    caller = event.get("callerIpAddress", default="<UNKNOWN_CALLER>")

    return f"Azure Key Vault permanently purged [{keyvault}] from [{caller}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")
    keyvault_name = extract_resource_name_from_id(resource_id, "deletedVaults", default="")
    if keyvault_name:
        context["keyvault_name"] = keyvault_name

    return context

Field Validations

Loading…

Comments (0)

Loading comments...