azure-defender-redirect-workspace
Write workspace settings (Microsoft.Security/workspaceSettings/write); redirecting the Defender data pipeline to a different or non-existent workspace severs log collection and alert generation subscription-wide.
match (effective permission)
{
"action": "Microsoft.Security/workspaceSettings/write",
"scope_type": "subscription"
}
where
principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/workspaceSettings/write at subscription scope
emit
| source type | Identity |
|---|---|
| target type | ConfigurationService |
| source | <principal> |
| target | <Defender workspace settings node (ConfigurationService) in the subscription> |
| permissions | Microsoft.Security/workspaceSettings/write |
| state logic | ACTIVE when the effective permission is confirmed at subscription scope. BLOCKED if a deny assignment covers workspaceSettings/write at effective scope. NOTE: Redirecting workspace settings severs the log-collection pipeline subscription-wide. This is a DETECTIVE-CONTROL tampering edge with broad impact — all Defender data collection is redirected (or halted if the target workspace is invalid/deleted). It does not affect access controls or set BLOCKED on any resource-access edge. |
Narrative
{principal.name} can modify Defender workspace settings for subscription {target.name} (Microsoft.Security/workspaceSettings/write). Redirecting the data-collection workspace to a no-op or attacker-controlled destination severs the Defender log pipeline and halts alert generation subscription-wide - an effective cover-tracks primitive that eliminates all Defender visibility at once.
Raw rule rules/derived/azure/defender.yaml
id: azure-defender-redirect-workspace
emits: CanModify
description: Write workspace settings (Microsoft.Security/workspaceSettings/write); redirecting the Defender
data pipeline to a different or non-existent workspace severs log collection and alert generation subscription-wide.
match_effective_permission:
action: Microsoft.Security/workspaceSettings/write
scope_type: subscription
where:
- principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/workspaceSettings/write
at subscription scope
emit:
source_type: Identity
target_type: ConfigurationService
source: <principal>
target: <Defender workspace settings node (ConfigurationService) in the subscription>
permissions:
- Microsoft.Security/workspaceSettings/write
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed at subscription scope. BLOCKED if a\
\ deny assignment covers workspaceSettings/write at effective scope. NOTE: Redirecting workspace settings\
\ severs the log-collection pipeline subscription-wide. This is a DETECTIVE-CONTROL tampering edge\
\ with broad impact \u2014 all Defender data collection is redirected (or halted if the target workspace\
\ is invalid/deleted). It does not affect access controls or set BLOCKED on any resource-access edge."
confidence: 0.93
derived_from:
- HasPermission(Identity, ConfigurationService:workspaceSettings, Microsoft.Security/workspaceSettings/write)
false_positive_note: "workspaceSettings/write allows modification of the workspace where Defender collects\
\ logs. Changing this setting to a non-existent workspace, a workspace in a different subscription,\
\ or an attacker-controlled workspace redirects or halts all Defender log collection and alert generation\
\ at subscription scope. This is a high-impact evasion primitive \u2014 broader than suppression rules\
\ (which target specific alerts) and comparable in scope to plan disablement (which targets specific\
\ resource types). Confirm the target workspace is valid and authorized before assuming normal operation."
narrative: "{principal.name} can modify Defender workspace settings for subscription {target.name} (Microsoft.Security/workspaceSettings/write).\
\ Redirecting the data-collection workspace to a no-op or attacker-controlled destination severs the\
\ Defender log pipeline and halts alert generation subscription-wide \u2014 an effective cover-tracks\
\ primitive that eliminates all Defender visibility at once."