azure-auto-webhook-public

id: azure-auto-webhook-public
emits: ExposedToInternet
description: An enabled Automation Account webhook with a public URI is internet-triggerable; any holder
  of the URI can start a runbook job.
match:
- - account: null
  - Contains
  - webhook: null
where:
- node_type(?account) == AutomationService
- node_type(?webhook) == Webhook
- ?webhook.isEnabled == true
- ?account.publicNetworkAccess != Disabled
emit:
  source_type: GenericCompute
  target_type: AnonymousIdentity
  source: ?account
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - service_state
  state_logic: ACTIVE when the webhook is enabled AND the account's public network access is not Disabled.
    CONDITIONAL(service_state) if the account is suspended. BLOCKED if publicNetworkAccess=Disabled or
    the webhook is disabled.
  confidence: 0.88
  derived_from:
  - webhook.isEnabled=true in account
  - account.publicNetworkAccess != Disabled
  false_positive_note: "The URI secret is NOT recoverable from ARM after creation; actual exploitation\
    \ requires the attacker to hold the URI. This edge models that the webhook SURFACE IS INTERNET-EXPOSED\
    \ (a potential entry point), not that every internet user holds the URI. Combine with URI leakage\
    \ evidence (code, logs, config) for ACTIVE exploitation assessment. If publicNetworkAccess=Disabled,\
    \ no internet reachability exists \u2014 BLOCKED."
  narrative: Automation Account {account.name} has an enabled webhook with a public URI; any internet
    party holding the URI secret can trigger runbook jobs as the account's managed identity without ARM
    RBAC.