azure-monitor-write-diagnostic-setting
Write or replace a diagnostic setting, redirecting log export to an attacker-controlled destination or selectively excluding categories - a stealthier evasion than deletion because the setting remains present.
match (effective permission)
{
"action": "Microsoft.Insights/diagnosticSettings/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | LoggingService |
| source | <principal> |
| target | <diagnostic setting (LoggingService node)> |
| permissions | Microsoft.Insights/diagnosticSettings/write |
| conditions | iam_permission deny_assignment |
| state logic | ACTIVE when the principal holds Microsoft.Insights/diagnosticSettings/write at the effective scope with no deny assignment. Write can create a new setting or overwrite an existing one. Confidence 0.90 (slightly lower than delete) because a write-only write that adds redundant logging is benign; threat requires either (a) redirecting the storageAccountId/workspaceId/eventHubAuthorizationRuleId to an attacker-controlled destination, or (b) setting enabled=false on selected log categories or the overall setting. BLOCKED if a deny assignment covers diagnosticSettings/write. |
Narrative
{principal.name} can create or overwrite the diagnostic setting {target.name} (Microsoft.Insights/diagnosticSettings/write), redirecting log export to an attacker-controlled destination or selectively disabling log categories. The setting remains present but silenced or misdirected - a stealthy evasion.
Raw rule rules/derived/azure/monitor.yaml
id: azure-monitor-write-diagnostic-setting
emits: CanModifyConfiguration
description: "Write or replace a diagnostic setting, redirecting log export to an attacker-controlled\
\ destination or selectively excluding categories \u2014 a stealthier evasion than deletion because\
\ the setting remains present."
match_effective_permission:
action: Microsoft.Insights/diagnosticSettings/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: LoggingService
source: <principal>
target: <diagnostic setting (LoggingService node)>
permissions:
- Microsoft.Insights/diagnosticSettings/write
conditions:
- iam_permission
- deny_assignment
state_logic: ACTIVE when the principal holds Microsoft.Insights/diagnosticSettings/write at the effective
scope with no deny assignment. Write can create a new setting or overwrite an existing one. Confidence
0.90 (slightly lower than delete) because a write-only write that adds redundant logging is benign;
threat requires either (a) redirecting the storageAccountId/workspaceId/eventHubAuthorizationRuleId
to an attacker-controlled destination, or (b) setting enabled=false on selected log categories or
the overall setting. BLOCKED if a deny assignment covers diagnosticSettings/write.
confidence: 0.9
derived_from:
- 'effective permission: Microsoft.Insights/diagnosticSettings/write'
false_positive_note: "DEFENSE EVASION / REDIRECT. Write alone can be benign (adding a log destination)\
\ or malicious (redirecting to an attacker-controlled storage account, disabling categories). Emit\
\ CanModifyConfiguration regardless \u2014 the capability to redirect is the threat surface; analyst\
\ should assess the destination change. This is stealthier than delete because Azure Monitor does\
\ not generate an alert when a diagnostic setting is modified unless an activity-log alert is configured\
\ for Microsoft.Insights/diagnosticSettings/write operations. Do NOT chain to access escalation edges."
narrative: "{principal.name} can create or overwrite the diagnostic setting {target.name} (Microsoft.Insights/diagnosticSettings/write),\
\ redirecting log export to an attacker-controlled destination or selectively disabling log categories.\
\ The setting remains present but silenced or misdirected \u2014 a stealthy evasion."