azure-disk-sas-export-active
beginGetAccess/action on a disk with AllowAll (default) network access policy mints an internet-routable anonymous SAS download URL for the full VHD.
match (effective permission)
{
"action": "Microsoft.Compute/disks/beginGetAccess/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
disk.networkAccessPolicy in [AllowAll, null/unset]
emit
| source type | Identity |
|---|---|
| target type | BlockStorage |
| source | <principal> |
| target | <managed disk> |
| permissions | Microsoft.Compute/disks/beginGetAccess/action |
| state logic | ACTIVE: SAS URL is internet-routable for the SAS duration (default 60 min to 24 h) when disk.networkAccessPolicy is AllowAll (the default). Encryption does not block the SAS download; it gates plaintext readability (see azure-disk-cmk-gated-read for the CONDITIONAL(key_permission) branch). |
Narrative
{principal.name} can call beginGetAccess/action on disk {target.name} (default AllowAll network policy) to mint an internet-routable SAS download URL and copy the entire VHD (including OS secrets such as SAM, NTDS.dit, SSH private keys, or application credentials) to an external location with no OS credential.
Raw rule rules/derived/azure/disks.yaml
id: azure-disk-sas-export-active
emits: CanExfiltrate
description: beginGetAccess/action on a disk with AllowAll (default) network access policy mints an internet-routable
anonymous SAS download URL for the full VHD.
match_effective_permission:
action: Microsoft.Compute/disks/beginGetAccess/action
scope_type: resource|resourceGroup|subscription
where:
- disk.networkAccessPolicy in [AllowAll, null/unset]
emit:
source_type: Identity
target_type: BlockStorage
source: <principal>
target: <managed disk>
permissions:
- Microsoft.Compute/disks/beginGetAccess/action
conditions: []
state_logic: 'ACTIVE: SAS URL is internet-routable for the SAS duration (default 60 min to 24 h) when
disk.networkAccessPolicy is AllowAll (the default). Encryption does not block the SAS download; it
gates plaintext readability (see azure-disk-cmk-gated-read for the CONDITIONAL(key_permission) branch).'
confidence: 0.95
derived_from:
- HasPermission(principal, Microsoft.Compute/disks/beginGetAccess/action, disk)
false_positive_note: "This rule applies only when networkAccessPolicy is AllowAll or unset (the default).\
\ CMK encryption does NOT prevent the SAS download from being minted or fetched; the VHD is downloaded\
\ as encrypted blobs. Only the plaintext readability is gated \u2014 model that via azure-disk-cmk-gated-read,\
\ not here."
narrative: '{principal.name} can call beginGetAccess/action on disk {target.name} (default AllowAll
network policy) to mint an internet-routable SAS download URL and copy the entire VHD (including OS
secrets such as SAM, NTDS.dit, SSH private keys, or application credentials) to an external location
with no OS credential.'