azure-monitor-write-log-profile

Write or replace the subscription Activity Log profile, redirecting export to an attacker-controlled destination or narrowing the captured regions and categories.

derived azure emits CanModifyConfiguration

match (effective permission)

{ "action": "Microsoft.Insights/logProfiles/write", "scope_type": "subscription" }

emit

source typeIdentity
target typeLoggingService
source<principal>
target<log profile (LoggingService node)>
permissionsMicrosoft.Insights/logProfiles/write
conditionsiam_permission deny_assignment
state logicACTIVE when the permission is confirmed at subscription scope with no deny assignment. POTENTIAL if no log profile exists (write creates one, but creation with an attacker-controlled destination requires confirmation). BLOCKED if deny assignment covers logProfiles/write.

Narrative

{principal.name} can write or replace the subscription log profile {target.name} (Microsoft.Insights/logProfiles/write), redirecting Activity Log export to an attacker-controlled storage account or Event Hub, or narrowing the captured regions and categories.

Raw rule rules/derived/azure/monitor.yaml

id: azure-monitor-write-log-profile
emits: CanModifyConfiguration
description: Write or replace the subscription Activity Log profile, redirecting export to an attacker-controlled
  destination or narrowing the captured regions and categories.
match_effective_permission:
  action: Microsoft.Insights/logProfiles/write
  scope_type: subscription
emit:
  source_type: Identity
  target_type: LoggingService
  source: <principal>
  target: <log profile (LoggingService node)>
  permissions:
  - Microsoft.Insights/logProfiles/write
  conditions:
  - iam_permission
  - deny_assignment
  state_logic: ACTIVE when the permission is confirmed at subscription scope with no deny assignment.
    POTENTIAL if no log profile exists (write creates one, but creation with an attacker-controlled destination
    requires confirmation). BLOCKED if deny assignment covers logProfiles/write.
  confidence: 0.85
  derived_from:
  - 'effective permission: Microsoft.Insights/logProfiles/write'
  false_positive_note: DEFENSE EVASION / REDIRECT. Same caveats as azure-monitor-write-diagnostic-setting.
    logProfiles/write is the legacy API; most modern evasion targets subscription-scope diagnostic settings
    instead. Emit with lower priority than delete primitives. Do NOT chain to access edges.
  narrative: '{principal.name} can write or replace the subscription log profile {target.name} (Microsoft.Insights/logProfiles/write),
    redirecting Activity Log export to an attacker-controlled storage account or Event Hub, or narrowing
    the captured regions and categories.'
move · open · esc close