azure-aml-environment-write
Register a malicious custom Docker environment image; when a job references it, the attacker container runs as the cluster MI.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/environments/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <AML compute cluster (BatchJob)> |
| permissions | Microsoft.MachineLearningServices/workspaces/environments/write |
| conditions | trigger_exists |
| state logic | CONDITIONAL(trigger_exists) by default — the malicious environment is registered but runs only when a job is submitted referencing it. Upgrade to ACTIVE when the attacker can also submit a job (workspaces/jobs/write) that explicitly uses the registered environment. |
Narrative
{principal.name} can register a malicious Docker environment (workspaces/environments/write); when a job is submitted using this environment, the attacker container runs on cluster {target.name} as its managed identity.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-environment-write
emits: CanModifyCode
description: Register a malicious custom Docker environment image; when a job references it, the attacker
container runs as the cluster MI.
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/environments/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
source: <principal>
target: <AML compute cluster (BatchJob)>
permissions:
- Microsoft.MachineLearningServices/workspaces/environments/write
conditions:
- trigger_exists
state_logic: "CONDITIONAL(trigger_exists) by default \u2014 the malicious environment is registered\
\ but runs only when a job is submitted referencing it. Upgrade to ACTIVE when the attacker can also\
\ submit a job (workspaces/jobs/write) that explicitly uses the registered environment."
false_positive_note: "The environment write alone does not cause execution; a job submission that references\
\ the malicious environment is required. Emit ACTIVE only when the attacker ALSO holds workspaces/jobs/write\
\ (job-submit path). Do not emit for curated (Microsoft-managed) environments \u2014 those cannot\
\ be overwritten. Custom environments must point to an attacker-controlled image in ACR or Docker\
\ Hub to materialize code execution."
narrative: '{principal.name} can register a malicious Docker environment (workspaces/environments/write);
when a job is submitted using this environment, the attacker container runs on cluster {target.name}
as its managed identity.'