azure-auto-jobschedule-write
Create or modify a recurring job schedule that starts a runbook in an Automation Account.
match (effective permission)
{
"any_of": [
{
"action": "Microsoft.Automation/automationAccounts/jobSchedules/write",
"scope_type": "resource|resourceGroup|subscription"
},
{
"action": "Microsoft.Automation/automationAccounts/schedules/write",
"scope_type": "resource|resourceGroup|subscription"
}
]
}
emit
| source type | Identity |
|---|---|
| target type | Scheduler |
| source | <principal> |
| target | <schedule (Scheduler) for the runbook> |
| permissions | Microsoft.Automation/automationAccounts/jobSchedules/write Microsoft.Automation/automationAccounts/schedules/write |
| conditions | service_state |
| state logic | ACTIVE when the permission is confirmed. Creates a time-based trigger that repeatedly starts the targeted runbook — useful for persistence (code executes without further attacker interaction). BLOCKED if deny assignment covers jobSchedules/write. |
Narrative
{principal.name} can create a recurring schedule (automationAccounts/jobSchedules/write) to repeatedly start a runbook in Automation Account {target.name}, enabling persistent code execution as the account's managed identity.
Raw rule rules/derived/azure/automation.yaml
id: azure-auto-jobschedule-write
emits: CanSchedule
description: Create or modify a recurring job schedule that starts a runbook in an Automation Account.
match_effective_permission:
any_of:
- action: Microsoft.Automation/automationAccounts/jobSchedules/write
scope_type: resource|resourceGroup|subscription
- action: Microsoft.Automation/automationAccounts/schedules/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Scheduler
source: <principal>
target: <schedule (Scheduler) for the runbook>
permissions:
- Microsoft.Automation/automationAccounts/jobSchedules/write
- Microsoft.Automation/automationAccounts/schedules/write
conditions:
- service_state
state_logic: "ACTIVE when the permission is confirmed. Creates a time-based trigger that repeatedly\
\ starts the targeted runbook \u2014 useful for persistence (code executes without further attacker\
\ interaction). BLOCKED if deny assignment covers jobSchedules/write."
confidence: 0.95
derived_from:
- 'effective permission: Microsoft.Automation/automationAccounts/jobSchedules/write OR schedules/write'
- 'cicd-chains.yaml: cicd-trigger-runner-executes-as (scheduled trigger upgrades the run path to ACTIVE
for CONDITIONAL edges)'
false_positive_note: "CanSchedule creates a RECURRING trigger \u2014 the attacker can establish persistent\
\ code execution as the MI without holding further permissions after schedule creation. Pair with\
\ azure-auto-runbook-write (CanModifyCode) to confirm full attack path ACTIVE."
narrative: '{principal.name} can create a recurring schedule (automationAccounts/jobSchedules/write)
to repeatedly start a runbook in Automation Account {target.name}, enabling persistent code execution
as the account''s managed identity.'