ListKeys is an Azure management operation that returns storage-account access keys. These keys can be used later to authenticate to the storage service, often independently of the original sign-in session. Because it works through the control plane, the request may succeed even when the attacker is not interacting with the data directly.
In cyber attacks, ListKeys becomes valuable after an identity compromise. If a service principal or other workload identity has permission to call it, an attacker can retrieve long-lived credentials and expand access to blobs, files, or queues. Defenders should treat ListKeys as sensitive activity: restrict it with least privilege, prefer managed identities, monitor for unusual ARM calls, and rotate storage keys when exposure is suspected. Resource locks may slow deletion, but they do not stop credential retrieval.