azure-mi-start-unlocks-imds

An attacker who can start a stopped host can then retrieve IMDS tokens for its bound MI.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ManagedIdentity`
source	`?attacker`
target	`?mi`
state logic	ACTIVE when the attacker can start the stopped host, which unlocks IMDS token retrieval. Starting the host removes the service_state gate that makes CanRetrieveToken(host,mi) CONDITIONAL in azure-mi-imds-token. For the attacker, this becomes unconditionally ACTIVE.

source type

Identity

target type

ManagedIdentity

source

?attacker

target

?mi

state logic

ACTIVE when the attacker can start the stopped host, which unlocks IMDS token retrieval. Starting the host removes the service_state gate that makes CanRetrieveToken(host,mi) CONDITIONAL in azure-mi-imds-token. For the attacker, this becomes unconditionally ACTIVE.

Narrative

{attacker.name} can start {host.name}, which is currently stopped/deallocated. Once running, {host.name} will expose IMDS tokens for managed identity {mi.name}, allowing {attacker.name} to retrieve the MI token and authenticate as {mi.name}.

Raw rule rules/derived/azure/managedidentity.yaml

id: azure-mi-start-unlocks-imds
emits: CanRetrieveToken
description: An attacker who can start a stopped host can then retrieve IMDS tokens for its bound MI.
match:
- - attacker: null
  - CanStart
  - host: null
- - host: null
  - CanRetrieveToken
  - mi: null
where:
- node_type(?mi) == ManagedIdentity
- node_class(?host) == Compute
- ?host.state == 'stopped' or ?host.state == 'deallocated'
- ?attacker != ?host
emit:
  source_type: Identity
  target_type: ManagedIdentity
  source: ?attacker
  target: ?mi
  permissions: []
  conditions: []
  state_logic: ACTIVE when the attacker can start the stopped host, which unlocks IMDS token retrieval.
    Starting the host removes the service_state gate that makes CanRetrieveToken(host,mi) CONDITIONAL
    in azure-mi-imds-token. For the attacker, this becomes unconditionally ACTIVE.
  confidence: 0.98
  derived_from:
  - ?attacker CanStart ?host
  - ?host CanRetrieveToken ?mi (azure-mi-imds-token)
  false_positive_note: "This rule emits CanRetrieveToken(attacker, mi) when the attacker can start a stopped\
    \ host bound to the MI. Do NOT emit if the host is already running (?host.state == 'running') \u2014\
    \ azure-mi-imds-token already emits ACTIVE for running hosts. Only emit for stopped/deallocated hosts.\
    \ The attacker identity must be distinct from the host node."
  narrative: '{attacker.name} can start {host.name}, which is currently stopped/deallocated. Once running,
    {host.name} will expose IMDS tokens for managed identity {mi.name}, allowing {attacker.name} to retrieve
    the MI token and authenticate as {mi.name}.'