Key Vault Contributor Privilege Escalation: Reading All Secrets via Access Policies
A holder of the built-in Key Vault Contributor role abuses its Microsoft.KeyVault/vaults/write permission to write itself a full data-plane access policy on a production Azure Key Vault, then dumps every secret, key, and certificate it holds. Working purely from the cloud audit trail, correlate the control-plane access-policy change in the Azure Activity Log with the data-plane secret, key, and certificate reads in the Key Vault diagnostic log, identify the principal and what it stole, and classify the privilege-escalation and credential-access techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the cloud trail. This is a no-answer briefing checkpoint.
Identify the principal behind the vault activity
30The suspicious secret reads were not made by a workload identity. Working through the cloud trail, identify the user account that drove the vault activity.
Pin down the escalation operation
30One control-plane operation turned a vault-management role into data access. Identify the Azure operation the account used to grant itself rights on the vault.
Classify the privilege-escalation technique
30Name what the account did when it added itself to the vault's access policies. Identify the MITRE ATT&CK sub-technique.
Inventory the stolen payment credential
30The account read several named secrets out of the vault. Identify the live payment-provider secret it exfiltrated so it can be revoked first.
Catch the highest-impact data-plane read
30Beyond secrets, the account exported an asset that enables host impersonation. Identify the certificate it read with its private key.
Locate the operator's source address
30The vault operations did not come from the corporate network. Identify the external IP that issued the policy change and the first secret reads.
Classify the credential-theft outcome
25Name what the bulk reads of secrets, keys, and the certificate amount to. Identify the credential-access technique.
8 tasks · 205 points total
Training Tools
Cloud Console
Cloud infrastructure logs
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View allCookie Heist: AiTM Session Theft to Payment-Fraud BEC
An adversary-in-the-middle phishing intrusion that turns into payment fraud without any malware. A voicemail-themed email with an HTML attachment routes a finance analyst through a redirector to an Evilginx2 proxy, which relays her real Microsoft 365 sign-in and steals the post-MFA session cookie. The attacker replays the cookie from a foreign hosting IP, bypassing MFA, then reads her mailbox, creates an email-hiding inbox rule keyed on a vendor's domain, deletes the phishing mail, and replies inside a live invoice thread asking the vendor to wire payment to a new account. Work the Entra sign-in audit, the Exchange Online mailbox operations, and the email evidence to reconstruct the chain.
Mounted and Loaded: ISO Container Delivery of the Bumblebee Loader
An ISO image attachment hides a visible shortcut beside a hidden DLL. The user mounts the container and runs the shortcut, which executes the Bumblebee loader via rundll32 against a DLL export. Bumblebee injects into a signed Windows Mail binary through WMI, beacons HTTPS to a C2 cluster, then layers a Meterpreter stager and a Cobalt Strike beacon. The operator runs AdFind discovery, dumps LSASS with ProcDump, creates a rogue local admin, installs AnyDesk for fallback access, and moves laterally with a harvested domain administrator before the intrusion is contained pre-encryption. Reconstruct the kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
GoldPickaxe: The First iOS Trojan Stealing Your Face
A mobile-first intrusion against a retail bank's managed iPhone fleet. A relationship officer is socially engineered into installing a fake government app through Apple TestFlight and trusting a rogue MDM profile, handing GoldFactory full control of the device. The GoldPickaxe.iOS trojan harvests identity documents and a facial-recognition video, intercepts SMS, and exfiltrates over three split channels: an RSA-encrypted HTTP API, a WebSocket command channel, and an RTMP face-video stream, all to enable AI face-swap fraud against the bank's facial verification. Reconstruct the chain from mobile-threat-defense, MDM, and perimeter firewall telemetry.