azure-eh-capture-destination-write
Modify the Capture configuration of an event hub (eventhubs/write) to redirect the Avro capture stream to an attacker-controlled storage account; all events are then captured to attacker storage.
match (effective permission)
{
"action": "Microsoft.EventHub/namespaces/eventhubs/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds namespaces/eventhubs/write at the event-hub or enclosing scope
the event hub has captureDescription.enabled=true OR the principal can enable Capture
emit
| source type | Identity |
|---|---|
| target type | Queue |
| source | <principal> |
| target | <event hub (Queue node)> |
| permissions | Microsoft.EventHub/namespaces/eventhubs/write |
| conditions | service_state |
| state logic | ACTIVE when the principal holds eventhubs/write AND can write to the target Storage account scope (Microsoft.Storage/storageAccounts/blobServices/containers/write is required by the Event Hubs service when configuring Capture — see Capture docs). CONDITIONAL(service_state) if Capture is not currently enabled (the attacker must also enable it, which requires the same write permission). BLOCKED if a deny assignment covers eventhubs/write. The downstream CanExfiltrate consequence (redirected Capture → all events written to attacker storage) is owned by the data-plane rules and cited here — NOT re-derived. |
Narrative
{principal.name} can modify the Capture configuration of event hub {target.name} (namespaces/eventhubs/write); redirecting captureDescription.destination to an attacker-controlled storage account causes all event stream data to be automatically written to that storage in Avro format - exfiltrating the full stream without requiring direct receive permissions.
Raw rule rules/derived/azure/eventhubs.yaml
id: azure-eh-capture-destination-write
emits: CanModifyConfiguration
description: Modify the Capture configuration of an event hub (eventhubs/write) to redirect the Avro capture
stream to an attacker-controlled storage account; all events are then captured to attacker storage.
match_effective_permission:
action: Microsoft.EventHub/namespaces/eventhubs/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds namespaces/eventhubs/write at the event-hub or enclosing scope
- the event hub has captureDescription.enabled=true OR the principal can enable Capture
emit:
source_type: Identity
target_type: Queue
source: <principal>
target: <event hub (Queue node)>
permissions:
- Microsoft.EventHub/namespaces/eventhubs/write
conditions:
- service_state
state_logic: "ACTIVE when the principal holds eventhubs/write AND can write to the target Storage account\
\ scope (Microsoft.Storage/storageAccounts/blobServices/containers/write is required by the Event\
\ Hubs service when configuring Capture \u2014 see Capture docs). CONDITIONAL(service_state) if Capture\
\ is not currently enabled (the attacker must also enable it, which requires the same write permission).\
\ BLOCKED if a deny assignment covers eventhubs/write. The downstream CanExfiltrate consequence (redirected\
\ Capture \u2192 all events written to attacker storage) is owned by the data-plane rules and cited\
\ here \u2014 NOT re-derived."
confidence: 0.9
derived_from:
- 'effective permission: Microsoft.EventHub/namespaces/eventhubs/write'
- 'data-plane rules: CanModifyConfiguration (Capture destination) + CanWriteData(attacker storage) =>
CanExfiltrate (CITED)'
- 'can-execute-as.yaml: execute-as-via-config-identity-swap (CanModifyConfiguration is a prerequisite
for config-based escalation chains)'
false_positive_note: "namespaces/eventhubs/write includes the full event hub entity write: partition\
\ count, message retention, consumer group management, AND captureDescription. The Capture-redirect\
\ attack requires (a) the principal can modify the event hub (eventhubs/write) AND (b) the destination\
\ storage account accepts writes from the Event Hubs service identity (namespace MI must have Storage\
\ Blob Data Contributor or Owner on the target container). If the attacker controls an Azure storage\
\ account but has not granted the namespace MI write on it, Capture will fail with an error \u2014\
\ only emit ACTIVE when both the eventhubs/write AND a path to the attacker's storage are confirmed.\
\ If Capture is not enabled and the principal can enable it, still emit (enabling + redirecting is\
\ the attack)."
narrative: "{principal.name} can modify the Capture configuration of event hub {target.name} (namespaces/eventhubs/write);\
\ redirecting captureDescription.destination to an attacker-controlled storage account causes all\
\ event stream data to be automatically written to that storage in Avro format \u2014 exfiltrating\
\ the full stream without requiring direct receive permissions."