azure-evg-read-events-via-redirect
Redirecting an event subscription's endpoint to an attacker-controlled webhook enables reading all event payloads from that topic (event exfiltration).
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?topic) ==
EventBus
?principal reached CanModifyConfiguration via azure-evg-subscription-write or azure-evg-create-subscription (eventSubscriptions/write on the topic)
emit
| source type | Identity |
|---|---|
| target type | EventBus |
| source | ?principal |
| target | ?topic |
| permissions | Microsoft.EventGrid/eventSubscriptions/write |
| state logic | ACTIVE when the CanModifyConfiguration edge (azure-evg-subscription-write or azure-evg-create-subscription) is ACTIVE — the attacker can redirect or create a subscription endpoint and receive all matching events. Inherit state from the contributing CanModifyConfiguration edge. BLOCKED if the subscription write is covered by a deny assignment. |
Narrative
{principal.name} can redirect the event subscription endpoint for {target.name} (eventSubscriptions/write); all future events from this topic are delivered to the attacker-controlled endpoint, exposing event payload data. If events carry credential material, credential-chains derives CanImpersonate.
Raw rule rules/derived/azure/eventgrid.yaml
id: azure-evg-read-events-via-redirect
emits: CanReadData
description: Redirecting an event subscription's endpoint to an attacker-controlled webhook enables reading
all event payloads from that topic (event exfiltration).
match:
- - principal: null
- CanModifyConfiguration
- topic: null
where:
- node_type(?topic) == EventBus
- ?principal reached CanModifyConfiguration via azure-evg-subscription-write or azure-evg-create-subscription
(eventSubscriptions/write on the topic)
emit:
source_type: Identity
target_type: EventBus
source: ?principal
target: ?topic
permissions:
- Microsoft.EventGrid/eventSubscriptions/write
conditions: []
state_logic: "ACTIVE when the CanModifyConfiguration edge (azure-evg-subscription-write or azure-evg-create-subscription)\
\ is ACTIVE \u2014 the attacker can redirect or create a subscription endpoint and receive all matching\
\ events. Inherit state from the contributing CanModifyConfiguration edge. BLOCKED if the subscription\
\ write is covered by a deny assignment."
confidence: min(contributing_confidences) * 0.95
derived_from:
- 'azure-evg-subscription-write OR azure-evg-create-subscription: ?principal CanModifyConfiguration
?topic'
- 'messaging-chains.yaml: messaging-resource-policy-cross-boundary-trust cites this pattern for data
exfil (CanReadData over event stream)'
false_positive_note: "CanReadData here is over the EVENT STREAM (event payloads), not a traditional\
\ storage resource. The value depends on what the events contain: for system topics (Storage, Key\
\ Vault, Service Bus), the events contain metadata about resource operations (object names, timestamps,\
\ operation types) rather than full data payloads \u2014 intelligence value, not direct data access.\
\ For custom topics, events may contain full application data (orders, transactions, user actions).\
\ Confirm the topic source type and expected payload schema before scoring this edge high. If events\
\ contain credential material (access keys, connection strings), credential-chains read-secret-yields-identity\
\ fires via ContainsSecret path."
narrative: '{principal.name} can redirect the event subscription endpoint for {target.name} (eventSubscriptions/write);
all future events from this topic are delivered to the attacker-controlled endpoint, exposing event
payload data. If events carry credential material, credential-chains derives CanImpersonate.'