azure-adf-shir-exposes-cred

A Self-Hosted IR node VM stores encrypted linked service credentials in its local credential store; OS-level access to the node decrypts them.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`Secret`
source	`<SHIR node VirtualMachine>`
target	`<linked service credentials stored in SHIR node credential store (Credential node)>`
conditions	`iam_permission`
state logic	CONDITIONAL(iam_permission) — the node credential store is DPAPI-encrypted; accessing it requires CanExecuteCommand on the SHIR VM (OS-level access). ACTIVE only when combined with CanExecuteCommand(?p, ?vm). BLOCKED if the SHIR node is deregistered from the factory.

source type

Compute

target type

Secret

source

<SHIR node VirtualMachine>

target

<linked service credentials stored in SHIR node credential store (Credential node)>

conditions

iam_permission

state logic

CONDITIONAL(iam_permission) — the node credential store is DPAPI-encrypted; accessing it requires CanExecuteCommand on the SHIR VM (OS-level access). ACTIVE only when combined with CanExecuteCommand(?p, ?vm). BLOCKED if the SHIR node is deregistered from the factory.

Narrative

Self-Hosted IR node {vm.name} stores encrypted linked service credentials in its local DPAPI-protected credential store; an attacker with OS-level command execution on this VM can decrypt and retrieve those credentials.

Raw rule rules/derived/azure/datafactory.yaml

id: azure-adf-shir-exposes-cred
emits: ExposesCredential
description: A Self-Hosted IR node VM stores encrypted linked service credentials in its local credential
  store; OS-level access to the node decrypts them.
match:
- - vm: null
  - ExecutesAs
  - identity: null
where:
- node_type(?vm) == VirtualMachine
- ?vm is a Self-Hosted Integration Runtime node (registered to a Microsoft.DataFactory/factories/integrationruntimes
  of type SelfHosted)
emit:
  source_type: Compute
  target_type: Secret
  source: <SHIR node VirtualMachine>
  target: <linked service credentials stored in SHIR node credential store (Credential node)>
  permissions: []
  conditions:
  - iam_permission
  state_logic: "CONDITIONAL(iam_permission) \u2014 the node credential store is DPAPI-encrypted; accessing\
    \ it requires CanExecuteCommand on the SHIR VM (OS-level access). ACTIVE only when combined with CanExecuteCommand(?p,\
    \ ?vm). BLOCKED if the SHIR node is deregistered from the factory."
  confidence: 0.8
  derived_from:
  - '<ExecutesAs edge: ?vm -> ?identity>'
  - SHIR node stores encrypted credentials for linked services using SelfHosted IR
  false_positive_note: "This rule emits the FACT that the SHIR node stores linked service creds, not that\
    \ any actor can access them directly. The attack path requires CanExecuteCommand on the SHIR VM first\
    \ (e.g., via Microsoft.Compute/virtualMachines/runCommand/action or VM agent). The credential decryption\
    \ uses the SHIR Windows Data Protection API (DPAPI) or the SHIR credential store API \u2014 neither\
    \ is remotely callable without OS access. Do NOT emit CanReadSecret directly from this rule; it feeds\
    \ a credential-chains derivation only when combined with a CanExecuteCommand edge."
  narrative: Self-Hosted IR node {vm.name} stores encrypted linked service credentials in its local DPAPI-protected
    credential store; an attacker with OS-level command execution on this VM can decrypt and retrieve
    those credentials.