AZGetSecrets

The ability to read secrets from key vaults.

Abuse Info

Use PowerShell or PowerZure to fetch the certificate from the key vault.

Via PowerZure:

• Get-AzureKeyVaultContent
• Export-AzureKeyVaultcontent

Opsec Considerations

Azure will create a new log event for the key vault whenever a secret is accessed.

References

• https://blog.netspi.com/azure-automation-accounts-key-stores/
• https://powerzure.readthedocs.io/en/latest/Functions/operational.html#get-azurekeyvaultcontent
• https://specterops.io/blog/2022/08/03/introducing-bloodhound-4-2-the-azure-refactor/