azure-monitor-write-log-profile
Write or replace the subscription Activity Log profile, redirecting export to an attacker-controlled destination or narrowing the captured regions and categories.
match (effective permission)
{
"action": "Microsoft.Insights/logProfiles/write",
"scope_type": "subscription"
}
emit
| source type | Identity |
|---|---|
| target type | LoggingService |
| source | <principal> |
| target | <log profile (LoggingService node)> |
| permissions | Microsoft.Insights/logProfiles/write |
| conditions | iam_permission deny_assignment |
| state logic | ACTIVE when the permission is confirmed at subscription scope with no deny assignment. POTENTIAL if no log profile exists (write creates one, but creation with an attacker-controlled destination requires confirmation). BLOCKED if deny assignment covers logProfiles/write. |
Narrative
{principal.name} can write or replace the subscription log profile {target.name} (Microsoft.Insights/logProfiles/write), redirecting Activity Log export to an attacker-controlled storage account or Event Hub, or narrowing the captured regions and categories.
Raw rule rules/derived/azure/monitor.yaml
id: azure-monitor-write-log-profile
emits: CanModifyConfiguration
description: Write or replace the subscription Activity Log profile, redirecting export to an attacker-controlled
destination or narrowing the captured regions and categories.
match_effective_permission:
action: Microsoft.Insights/logProfiles/write
scope_type: subscription
emit:
source_type: Identity
target_type: LoggingService
source: <principal>
target: <log profile (LoggingService node)>
permissions:
- Microsoft.Insights/logProfiles/write
conditions:
- iam_permission
- deny_assignment
state_logic: ACTIVE when the permission is confirmed at subscription scope with no deny assignment.
POTENTIAL if no log profile exists (write creates one, but creation with an attacker-controlled destination
requires confirmation). BLOCKED if deny assignment covers logProfiles/write.
confidence: 0.85
derived_from:
- 'effective permission: Microsoft.Insights/logProfiles/write'
false_positive_note: DEFENSE EVASION / REDIRECT. Same caveats as azure-monitor-write-diagnostic-setting.
logProfiles/write is the legacy API; most modern evasion targets subscription-scope diagnostic settings
instead. Emit with lower priority than delete primitives. Do NOT chain to access edges.
narrative: '{principal.name} can write or replace the subscription log profile {target.name} (Microsoft.Insights/logProfiles/write),
redirecting Activity Log export to an attacker-controlled storage account or Event Hub, or narrowing
the captured regions and categories.'