Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when an Azure AI Foundry account enables API-key-based access. Use of Azure OpenAI API keys is discouraged by Microsoft as those keys are not tied to a specific identity and lack any fine-grained permission scopes.

Strategy

This rule monitors Azure Activity Log events for azure.cognitiveservices resources and links two key-listing actions against the same Cognitive Services account. The first step matches when MICROSOFT.COGNITIVESERVICES/ACCOUNTS/LISTKEYS/ACTION fails with a status message indicating that disableLocalAuth is set to true, meaning API-key access is turned off. The second step matches a successful key retrieval (MICROSOFT.COGNITIVESERVICES/ACCOUNTS/LISTKEYS/ACTION with @evt.outcome of Success) on that same account within three hours, indicating that API-key access was re-enabled in between and keys are now active.

Triage & Response

• Examine whether the {{@usr.id}} that performed this activity had a legitimate reason to modify the Azure AI Foundry account configuration and retrieve its keys.
• Review the {{@callerIpAddress}} and {{@identity.claims}} associated with both events to determine if the activity originated from expected infrastructure, such as a known CI/CD pipeline or administrative workstation, and whether the same actor performed both steps.
• Look for a MICROSOFT.COGNITIVESERVICES/ACCOUNTS/WRITE event on {{@resource_name}} between the two key-listing events to confirm who re-enabled local authentication and whether that change was approved.
• Examine subsequent use of API keys for suspicious behavior, such as calls from unexpected IPs or calls to new services.