azure-auto-jobschedule-write

Create or modify a recurring job schedule that starts a runbook in an Automation Account.

derived azure emits CanSchedule

match (effective permission)

{ "any_of": [ { "action": "Microsoft.Automation/automationAccounts/jobSchedules/write", "scope_type": "resource|resourceGroup|subscription" }, { "action": "Microsoft.Automation/automationAccounts/schedules/write", "scope_type": "resource|resourceGroup|subscription" } ] }

emit

source typeIdentity
target typeScheduler
source<principal>
target<schedule (Scheduler) for the runbook>
permissionsMicrosoft.Automation/automationAccounts/jobSchedules/write Microsoft.Automation/automationAccounts/schedules/write
conditionsservice_state
state logicACTIVE when the permission is confirmed. Creates a time-based trigger that repeatedly starts the targeted runbook — useful for persistence (code executes without further attacker interaction). BLOCKED if deny assignment covers jobSchedules/write.

Narrative

{principal.name} can create a recurring schedule (automationAccounts/jobSchedules/write) to repeatedly start a runbook in Automation Account {target.name}, enabling persistent code execution as the account's managed identity.

Raw rule rules/derived/azure/automation.yaml

id: azure-auto-jobschedule-write
emits: CanSchedule
description: Create or modify a recurring job schedule that starts a runbook in an Automation Account.
match_effective_permission:
  any_of:
  - action: Microsoft.Automation/automationAccounts/jobSchedules/write
    scope_type: resource|resourceGroup|subscription
  - action: Microsoft.Automation/automationAccounts/schedules/write
    scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Scheduler
  source: <principal>
  target: <schedule (Scheduler) for the runbook>
  permissions:
  - Microsoft.Automation/automationAccounts/jobSchedules/write
  - Microsoft.Automation/automationAccounts/schedules/write
  conditions:
  - service_state
  state_logic: "ACTIVE when the permission is confirmed. Creates a time-based trigger that repeatedly\
    \ starts the targeted runbook \u2014 useful for persistence (code executes without further attacker\
    \ interaction). BLOCKED if deny assignment covers jobSchedules/write."
  confidence: 0.95
  derived_from:
  - 'effective permission: Microsoft.Automation/automationAccounts/jobSchedules/write OR schedules/write'
  - 'cicd-chains.yaml: cicd-trigger-runner-executes-as (scheduled trigger upgrades the run path to ACTIVE
    for CONDITIONAL edges)'
  false_positive_note: "CanSchedule creates a RECURRING trigger \u2014 the attacker can establish persistent\
    \ code execution as the MI without holding further permissions after schedule creation. Pair with\
    \ azure-auto-runbook-write (CanModifyCode) to confirm full attack path ACTIVE."
  narrative: '{principal.name} can create a recurring schedule (automationAccounts/jobSchedules/write)
    to repeatedly start a runbook in Automation Account {target.name}, enabling persistent code execution
    as the account''s managed identity.'
move · open · esc close