azure-auto-connection-write
Modify or replace Automation Account connections, including legacy RunAs service principal credentials.
match (effective permission)
{
"action": "Microsoft.Automation/automationAccounts/connections/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds automationAccounts/connections/write at the automationAccount scope
emit
| source type | Identity |
|---|---|
| target type | GenericCompute |
| source | <principal> |
| target | <Automation Account (AutomationService)> |
| permissions | Microsoft.Automation/automationAccounts/connections/write |
| state logic | ACTIVE when the principal holds connections/write — the attacker can create, modify, or replace connections including the legacy RunAs SP connection (certificate). Runbooks calling Get-AutomationConnection retrieve the attacker-injected or hijacked connection, yielding access to the RunAs SP or any other service the connection targets. BLOCKED if a deny assignment covers connections/write. |
Narrative
{principal.name} can create or modify connections in Automation Account (automationAccounts/connections/write); any runbook that calls Get-AutomationConnection retrieves attacker-injected or hijacked connection credentials (including legacy RunAs SP certificates), yielding cross-service escalation.
Raw rule rules/derived/azure/automation.yaml
id: azure-auto-connection-write
emits: CanModifyConfiguration
description: Modify or replace Automation Account connections, including legacy RunAs service principal
credentials.
match_effective_permission:
action: Microsoft.Automation/automationAccounts/connections/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds automationAccounts/connections/write at the automationAccount scope
emit:
source_type: Identity
target_type: GenericCompute
source: <principal>
target: <Automation Account (AutomationService)>
permissions:
- Microsoft.Automation/automationAccounts/connections/write
conditions: []
state_logic: "ACTIVE when the principal holds connections/write \u2014 the attacker can create, modify,\
\ or replace connections including the legacy RunAs SP connection (certificate). Runbooks calling\
\ Get-AutomationConnection retrieve the attacker-injected or hijacked connection, yielding access\
\ to the RunAs SP or any other service the connection targets. BLOCKED if a deny assignment covers\
\ connections/write."
confidence: 0.9
derived_from:
- 'effective permission: Microsoft.Automation/automationAccounts/connections/write'
- 'can-execute-as.yaml: execute-as-via-config-identity-swap (CanModifyConfiguration reaching connection/credential)'
- 'credential-chains.yaml: ExposesCredential (runbook retrieves poisoned connection)'
false_positive_note: connections/write includes full CRUD on connections. The RunAs connection (type
AzureServicePrincipal with CertificateThumbprint) is the high-value target, but other connection types
(AWS, SQL, GitHub, etc.) also yield their target-service credentials when retrieved by a runbook.
Confirm the target connection type to prioritize RunAs (SP credential escalation) vs. other cloud/external
service credentials. Downgrade to CONDITIONAL if no runbooks retrieve connections or no run path exists.
narrative: '{principal.name} can create or modify connections in Automation Account (automationAccounts/connections/write);
any runbook that calls Get-AutomationConnection retrieves attacker-injected or hijacked connection
credentials (including legacy RunAs SP certificates), yielding cross-service escalation.'