azure-auto-variable-write
Write plaintext Automation Variables that runbooks read; enables behavior modification or credential injection into the execution sandbox.
match (effective permission)
{
"action": "Microsoft.Automation/automationAccounts/variables/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds automationAccounts/variables/write at the automationAccount scope
emit
| source type | Identity |
|---|---|
| target type | GenericCompute |
| source | <principal> |
| target | <Automation Account (AutomationService)> |
| permissions | Microsoft.Automation/automationAccounts/variables/write |
| state logic | ACTIVE when the principal holds variables/write — plaintext variables can be injected or modified to alter runbook behavior at runtime or inject credentials that runbooks read via Get-AutomationVariable. Encrypted variables require additional runbook execution to decrypt and re-inject. BLOCKED if a deny assignment covers variables/write. |
Narrative
{principal.name} can create or modify plaintext Automation Variables (automationAccounts/variables/write); runbooks that read these variables execute with attacker-injected values at runtime, enabling behavior modification or credential injection.
Raw rule rules/derived/azure/automation.yaml
id: azure-auto-variable-write
emits: CanModifyConfiguration
description: Write plaintext Automation Variables that runbooks read; enables behavior modification or
credential injection into the execution sandbox.
match_effective_permission:
action: Microsoft.Automation/automationAccounts/variables/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds automationAccounts/variables/write at the automationAccount scope
emit:
source_type: Identity
target_type: GenericCompute
source: <principal>
target: <Automation Account (AutomationService)>
permissions:
- Microsoft.Automation/automationAccounts/variables/write
conditions: []
state_logic: "ACTIVE when the principal holds variables/write \u2014 plaintext variables can be injected\
\ or modified to alter runbook behavior at runtime or inject credentials that runbooks read via Get-AutomationVariable.\
\ Encrypted variables require additional runbook execution to decrypt and re-inject. BLOCKED if a\
\ deny assignment covers variables/write."
confidence: 0.88
derived_from:
- 'effective permission: Microsoft.Automation/automationAccounts/variables/write'
- 'can-execute-as.yaml: execute-as-via-config-identity-swap (CanModifyConfiguration => configuration
escalation when paired with other edges)'
false_positive_note: variables/write allows the attacker to inject or modify any plaintext variable
read by runbooks. This is CanModifyConfiguration on the account's runtime state, not code modification
(runbooks/write). The threat depends on runbooks reading the poisoned variable (recon needed) and
a trigger path to run the runbook. Downgrade to CONDITIONAL if no runbooks consume the variable or
no run path exists.
narrative: '{principal.name} can create or modify plaintext Automation Variables (automationAccounts/variables/write);
runbooks that read these variables execute with attacker-injected values at runtime, enabling behavior
modification or credential injection.'