azure-disk-contains-secret

An OS-type managed disk (Windows or Linux) is heuristically classified as containing credential material: SAM/NTDS hive, /etc/shadow, SSH private keys, or application credential files.

explicit azure emits ContainsSecret

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

emit

source type	`BlockStorage`
target type	`Secret`
source	`<managed disk>`
target	`<embedded credential material (SAM/NTDS.dit on Windows; /etc/shadow, SSH keys on Linux; app config secrets)>`
state logic	ACTIVE: Raw-config fact (osType attribute observed directly from ARM). No conditions; this is metadata, not a capability gate.

source type

BlockStorage

target type

Secret

source

<managed disk>

target

<embedded credential material (SAM/NTDS.dit on Windows; /etc/shadow, SSH keys on Linux; app config secrets)>

state logic

ACTIVE: Raw-config fact (osType attribute observed directly from ARM). No conditions; this is metadata, not a capability gate.

Narrative

Disk {source.name} is an OS disk ({disk.osType}); it is expected to contain credential material (SAM/NTDS.dit hive for Windows, /etc/shadow and SSH private keys for Linux, and application config secrets). An attacker with SAS export access can harvest these credentials offline.

Raw rule rules/explicit/azure-disks.yaml

id: azure-disk-contains-secret
emits: ContainsSecret
description: 'An OS-type managed disk (Windows or Linux) is heuristically classified as containing credential
  material: SAM/NTDS hive, /etc/shadow, SSH private keys, or application credential files.'
match:
- resource_type: Microsoft.Compute/disks
  where:
  - disk.osType in [Windows, Linux]
  - disk.managedBy != null
emit:
  source_type: BlockStorage
  target_type: Secret
  source: <managed disk>
  target: <embedded credential material (SAM/NTDS.dit on Windows; /etc/shadow, SSH keys on Linux; app
    config secrets)>
  permissions: []
  state_logic: 'ACTIVE: Raw-config fact (osType attribute observed directly from ARM). No conditions;
    this is metadata, not a capability gate.'
  confidence: 0.75 for Windows (SAM/NTDS); 0.70 for Linux (shadow/SSH); 0.60 if unattached
  false_positive_note: 'Heuristic: an OS disk is highly likely to contain credential material, but the
    specific secrets are not enumerable without offline forensic analysis. Emit with confidence 0.75 for
    Windows (SAM/NTDS present on domain-joined VMs; lower if standalone workgroup VM) and 0.70 for Linux
    (shadow/SSH keys vary). Unattached OS disks (managedBy absent) retain the classification but confidence
    should be reduced to 0.60 (stale image may have rotated or no active secrets). Data disks (osType
    absent) may contain application secrets but at lower confidence (0.50); require additional evidence
    (disk name pattern, tags) before emitting. Do NOT emit for empty or unformatted disks.'
  narrative: Disk {source.name} is an OS disk ({disk.osType}); it is expected to contain credential material
    (SAM/NTDS.dit hive for Windows, /etc/shadow and SSH private keys for Linux, and application config
    secrets). An attacker with SAS export access can harvest these credentials offline.