azure-mg-move-sub-into-controlled-mg

Moving a subscription under a management group where the attacker is Owner makes the attacker's MG-scoped RBAC inherit down and take over the subscription.

derived azure emits CanTakeOwnership

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanAdminister {'mg': None} {'principal': None} CanModifyConfiguration {'mg': None}

where

node_type(?mg) == ManagementGroup ?principal effectively holds Microsoft.Management/managementGroups/subscriptions/write on the target subscription and managementGroups/write on ?mg (target parent) ?target_sub is a Subscription movable under ?mg (attacker has the required move perms on it and its current parent)

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?target_sub (the moved Subscription)`
permissions	`Microsoft.Management/managementGroups/subscriptions/write` `Microsoft.Management/managementGroups/write` `Microsoft.Authorization/roleAssignments/write`
conditions	`iam_permission`
state logic	CONDITIONAL(iam_permission) by default — realizable only once the attacker actually holds the move permissions on the target subscription AND its current parent (a two-step action). ACTIVE only when all move permissions on the subscription and both parents are confirmed. Once the sub is under ?mg, the attacker's Owner @ ?mg inherits (hierarchy-chains admin-inherits-down-contains) -> Controls(?target_sub) + CanEnterSubscription(?target_sub); this rule emits only the takeover PRIMITIVE, not the descent.

Narrative

{principal.name} can move subscription {target_sub.name} under management group {mg.name}, where it is Owner; the Owner assignment then inherits down and {principal.name} takes control of {target_sub.name}.

Raw rule rules/derived/azure/mgmtgroups.yaml

id: azure-mg-move-sub-into-controlled-mg
emits: CanTakeOwnership
description: Moving a subscription under a management group where the attacker is Owner makes the attacker's
  MG-scoped RBAC inherit down and take over the subscription.
match:
- - principal: null
  - CanAdminister
  - mg: null
- - principal: null
  - CanModifyConfiguration
  - mg: null
where:
- node_type(?mg) == ManagementGroup
- ?principal effectively holds Microsoft.Management/managementGroups/subscriptions/write on the target
  subscription and managementGroups/write on ?mg (target parent)
- ?target_sub is a Subscription movable under ?mg (attacker has the required move perms on it and its
  current parent)
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?target_sub  (the moved Subscription)
  permissions:
  - Microsoft.Management/managementGroups/subscriptions/write
  - Microsoft.Management/managementGroups/write
  - Microsoft.Authorization/roleAssignments/write
  conditions:
  - iam_permission
  state_logic: "CONDITIONAL(iam_permission) by default \u2014 realizable only once the attacker actually\
    \ holds the move permissions on the target subscription AND its current parent (a two-step action).\
    \ ACTIVE only when all move permissions on the subscription and both parents are confirmed. Once the\
    \ sub is under ?mg, the attacker's Owner @ ?mg inherits (hierarchy-chains admin-inherits-down-contains)\
    \ -> Controls(?target_sub) + CanEnterSubscription(?target_sub); this rule emits only the takeover\
    \ PRIMITIVE, not the descent."
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <CanAdminister principal->mg edge_id>
  - <CanModifyConfiguration principal->mg edge_id>
  false_positive_note: Requires BOTH Owner on the destination MG AND the full move permission set on the
    target subscription and its current parent MG. Moving a subscription does NOT by itself grant control
    unless the attacker actually controls the destination MG (Owner, not merely Contributor). If the destination
    MG control is CONDITIONAL/BLOCKED, this takeover inherits that. Do not emit when the attacker only
    has managementGroups/write without Owner on the destination.
  narrative: '{principal.name} can move subscription {target_sub.name} under management group {mg.name},
    where it is Owner; the Owner assignment then inherits down and {principal.name} takes control of {target_sub.name}.'