azure-netapp-account-contains-ad-credential

ANF account with AD join configured contains the machine account password as an AccessKey.

explicit azure emits ContainsCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`FileStorage`
target type	`AccessKey`
source	`?account`
target	`<AccessKey node representing the AD machine account password>`
state logic	if properties.activeDirectories is empty: DO NOT EMIT; else ACTIVE (structural fact — credential node exists as long as account has AD join configured). Emit BLOCKED only if the account is deleted.

source type

FileStorage

target type

AccessKey

source

?account

target

<AccessKey node representing the AD machine account password>

state logic

if properties.activeDirectories is empty: DO NOT EMIT; else ACTIVE (structural fact — credential node exists as long as account has AD join configured). Emit BLOCKED only if the account is deleted.

Narrative

ANF account {account.name} is configured with Active Directory join (properties.activeDirectories is non-empty) and contains the plaintext AD machine account password as an AccessKey sub-object. This credential can be retrieved by a principal with listCredentials/action permission.

Raw rule rules/explicit/azure-netapp.yaml

id: azure-netapp-account-contains-ad-credential
emits: ContainsCredential
description: ANF account with AD join configured contains the machine account password as an AccessKey.
match:
- - account: null
  - node_info
where:
- node_class(?account) == Storage and node_type(?account) == FileStorage
- ?account.provider_type == 'Microsoft.NetApp/netAppAccounts'
- '?account.properties.activeDirectories is non-empty  # AD join is configured'
emit:
  source_type: FileStorage
  target_type: AccessKey
  source: ?account
  target: <AccessKey node representing the AD machine account password>
  evidence_field: properties.activeDirectories present on netAppAccount
  state_logic: "if properties.activeDirectories is empty: DO NOT EMIT; else ACTIVE (structural fact \u2014\
    \ credential node exists as long as account has AD join configured). Emit BLOCKED only if the account\
    \ is deleted."
  confidence: '1.0'
  narrative: ANF account {account.name} is configured with Active Directory join (properties.activeDirectories
    is non-empty) and contains the plaintext AD machine account password as an AccessKey sub-object. This
    credential can be retrieved by a principal with listCredentials/action permission.