azure-adf-ir-write-config
Modify an ADF Integration Runtime configuration to swap SHIR VM assignment, reconfigure managed VNet, or change IR type - enables command execution or data exfiltration via network steering.
match (effective permission)
{
"action": "Microsoft.DataFactory/factories/integrationruntimes/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | ContainerCluster |
| source | <principal> |
| target | <ADF Integration Runtime (ContainerCluster node)> |
| permissions | Microsoft.DataFactory/factories/integrationruntimes/write |
| conditions | trigger_exists |
| state logic | CONDITIONAL(trigger_exists) — IR configuration changes take effect on the next IR initialization / pipeline run referencing the IR. ACTIVE when the attacker can also trigger a pipeline that uses the IR (pipelines/createRun/action or a Schedule trigger). A SHIR VM swap in particular elevates to CanExecuteCommand on the new VM (via can-execute-as CanModifyConfiguration path). Reconfiguring the Azure IR managed VNet enables steering of data-plane traffic to attacker endpoints (exfiltration via managed private endpoints). BLOCKED if a deny assignment covers integrationruntimes/write. |
Narrative
{principal.name} can modify the Integration Runtime configuration of {target.name} (Microsoft.DataFactory/factories/integrationruntimes/write), including SHIR VM assignment or managed VNet settings, which take effect on the next initialization.
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-ir-write-config
emits: CanModifyConfiguration
description: "Modify an ADF Integration Runtime configuration to swap SHIR VM assignment, reconfigure\
\ managed VNet, or change IR type \u2014 enables command execution or data exfiltration via network\
\ steering."
match_effective_permission:
action: Microsoft.DataFactory/factories/integrationruntimes/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: ContainerCluster
source: <principal>
target: <ADF Integration Runtime (ContainerCluster node)>
permissions:
- Microsoft.DataFactory/factories/integrationruntimes/write
conditions:
- trigger_exists
state_logic: "CONDITIONAL(trigger_exists) \u2014 IR configuration changes take effect on the next IR\
\ initialization / pipeline run referencing the IR. ACTIVE when the attacker can also trigger a pipeline\
\ that uses the IR (pipelines/createRun/action or a Schedule trigger). A SHIR VM swap in particular\
\ elevates to CanExecuteCommand on the new VM (via can-execute-as CanModifyConfiguration path). Reconfiguring\
\ the Azure IR managed VNet enables steering of data-plane traffic to attacker endpoints (exfiltration\
\ via managed private endpoints). BLOCKED if a deny assignment covers integrationruntimes/write."
confidence: 0.87
derived_from:
- 'effective permission: Microsoft.DataFactory/factories/integrationruntimes/write'
false_positive_note: IR configuration changes are realized on the next initialization. SHIR VM swap
is tracked as a separate sub-path via can-execute-as (CanModifyConfiguration on IR + ExecutesAs(new_vm,
identity) => CanExecuteAs). Swapping an IR to a malicious SHIR node should emit a separate CanExecuteCommand
edge if the swap is confirmed. Reconfiguring the managed VNet is a configuration change only; the
actual exfiltration path is via managed private endpoints + external sink, tracked by azure-adf-copy-exfiltrate.
narrative: '{principal.name} can modify the Integration Runtime configuration of {target.name} (Microsoft.DataFactory/factories/integrationruntimes/write),
including SHIR VM assignment or managed VNet settings, which take effect on the next initialization.'