azure-auto-variable-write

Write plaintext Automation Variables that runbooks read; enables behavior modification or credential injection into the execution sandbox.

derived azure emits CanModifyConfiguration

match (effective permission)

{ "action": "Microsoft.Automation/automationAccounts/variables/write", "scope_type": "resource|resourceGroup|subscription" }

where

principal effectively holds automationAccounts/variables/write at the automationAccount scope

emit

source typeIdentity
target typeGenericCompute
source<principal>
target<Automation Account (AutomationService)>
permissionsMicrosoft.Automation/automationAccounts/variables/write
state logicACTIVE when the principal holds variables/write — plaintext variables can be injected or modified to alter runbook behavior at runtime or inject credentials that runbooks read via Get-AutomationVariable. Encrypted variables require additional runbook execution to decrypt and re-inject. BLOCKED if a deny assignment covers variables/write.

Narrative

{principal.name} can create or modify plaintext Automation Variables (automationAccounts/variables/write); runbooks that read these variables execute with attacker-injected values at runtime, enabling behavior modification or credential injection.

Raw rule rules/derived/azure/automation.yaml

id: azure-auto-variable-write
emits: CanModifyConfiguration
description: Write plaintext Automation Variables that runbooks read; enables behavior modification or
  credential injection into the execution sandbox.
match_effective_permission:
  action: Microsoft.Automation/automationAccounts/variables/write
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds automationAccounts/variables/write at the automationAccount scope
emit:
  source_type: Identity
  target_type: GenericCompute
  source: <principal>
  target: <Automation Account (AutomationService)>
  permissions:
  - Microsoft.Automation/automationAccounts/variables/write
  conditions: []
  state_logic: "ACTIVE when the principal holds variables/write \u2014 plaintext variables can be injected\
    \ or modified to alter runbook behavior at runtime or inject credentials that runbooks read via Get-AutomationVariable.\
    \ Encrypted variables require additional runbook execution to decrypt and re-inject. BLOCKED if a\
    \ deny assignment covers variables/write."
  confidence: 0.88
  derived_from:
  - 'effective permission: Microsoft.Automation/automationAccounts/variables/write'
  - 'can-execute-as.yaml: execute-as-via-config-identity-swap (CanModifyConfiguration => configuration
    escalation when paired with other edges)'
  false_positive_note: variables/write allows the attacker to inject or modify any plaintext variable
    read by runbooks. This is CanModifyConfiguration on the account's runtime state, not code modification
    (runbooks/write). The threat depends on runbooks reading the poisoned variable (recon needed) and
    a trigger path to run the runbook. Downgrade to CONDITIONAL if no runbooks consume the variable or
    no run path exists.
  narrative: '{principal.name} can create or modify plaintext Automation Variables (automationAccounts/variables/write);
    runbooks that read these variables execute with attacker-injected values at runtime, enabling behavior
    modification or credential injection.'
move · open · esc close