azure-evg-create-subscription
Create a new event subscription on a topic or system topic, binding an event source to an attacker-controlled webhook endpoint.
match (effective permission)
{
"any_of": [
{
"action": "Microsoft.EventGrid/eventSubscriptions/write",
"scope_type": "resource|resourceGroup|subscription"
},
{
"action": "Microsoft.EventGrid/topics/eventSubscriptions/write",
"scope_type": "resource|resourceGroup|subscription"
},
{
"action": "Microsoft.EventGrid/systemTopics/eventSubscriptions/write",
"scope_type": "resource|resourceGroup|subscription"
}
]
}
where
no existing subscription is present, OR the attacker creates a NEW subscription (not modifying an existing one)
emit
| source type | Identity |
|---|---|
| target type | EventBus |
| source | <principal> |
| target | <Event Grid topic or system topic (EventBus) whose subscription is created> |
| permissions | Microsoft.EventGrid/eventSubscriptions/write |
| conditions | service_state |
| state logic | ACTIVE when the effective permission is confirmed and the topic or system topic exists and is active. Creating a NEW subscription establishes a new CanTrigger binding from the topic to the attacker's endpoint — events from the source start flowing to the attacker immediately after validation. BLOCKED if a deny assignment covers eventSubscriptions/write. |
Narrative
{principal.name} holds Microsoft.EventGrid/eventSubscriptions/write at the scope of {target.name}; it can create a new event subscription routing all topic events to an attacker-controlled endpoint. For system topics, this taps the Azure resource event stream without requiring publish access (the source resource publishes automatically).
Raw rule rules/derived/azure/eventgrid.yaml
id: azure-evg-create-subscription
emits: CanModifyConfiguration
description: Create a new event subscription on a topic or system topic, binding an event source to an
attacker-controlled webhook endpoint.
match_effective_permission:
any_of:
- action: Microsoft.EventGrid/eventSubscriptions/write
scope_type: resource|resourceGroup|subscription
- action: Microsoft.EventGrid/topics/eventSubscriptions/write
scope_type: resource|resourceGroup|subscription
- action: Microsoft.EventGrid/systemTopics/eventSubscriptions/write
scope_type: resource|resourceGroup|subscription
where:
- no existing subscription is present, OR the attacker creates a NEW subscription (not modifying an existing
one)
emit:
source_type: Identity
target_type: EventBus
source: <principal>
target: <Event Grid topic or system topic (EventBus) whose subscription is created>
permissions:
- Microsoft.EventGrid/eventSubscriptions/write
conditions:
- service_state
state_logic: "ACTIVE when the effective permission is confirmed and the topic or system topic exists\
\ and is active. Creating a NEW subscription establishes a new CanTrigger binding from the topic to\
\ the attacker's endpoint \u2014 events from the source start flowing to the attacker immediately\
\ after validation. BLOCKED if a deny assignment covers eventSubscriptions/write."
confidence: 0.93
derived_from:
- 'effective permission: Microsoft.EventGrid/eventSubscriptions/write'
- 'messaging-chains.yaml: messaging-publish-triggers-consumer: new subscription = new CanTrigger binding
(matches optional[0] of rule 1)'
false_positive_note: "Creating a new subscription on a system topic is particularly impactful because\
\ it exposes all resource events (blob operations, key vault events, resource group changes) without\
\ requiring publish access to the topic \u2014 the source (Azure service) publishes automatically.\
\ The attacker only needs eventSubscriptions/write at the resource scope to tap the event stream.\
\ For custom topics, a new subscription only receives events published AFTER subscription creation;\
\ historical events are not replayed. A subscription at subscription scope (global) covers ALL resources'\
\ system topics \u2014 broader than resource-group or resource scope."
narrative: '{principal.name} holds Microsoft.EventGrid/eventSubscriptions/write at the scope of {target.name};
it can create a new event subscription routing all topic events to an attacker-controlled endpoint.
For system topics, this taps the Azure resource event stream without requiring publish access (the
source resource publishes automatically).'