azure-netapp-account-write-ad-hijack

netAppAccounts/write permission on ANF account enables AD join configuration modification.

explicit azure emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`FileStorage`
source	`?principal`
target	`?account`
permissions	`Microsoft.NetApp/netAppAccounts/write`
conditions	`iam_permission`
state logic	if a deny assignment covers netAppAccounts/write at effective scope: BLOCKED; else ACTIVE. This is a control-plane action allowing AD join configuration mutation, potentially enabling credential hijacking or domain redirection.

source type

Identity

target type

FileStorage

source

?principal

target

?account

permissions

Microsoft.NetApp/netAppAccounts/write

conditions

iam_permission

state logic

if a deny assignment covers netAppAccounts/write at effective scope: BLOCKED; else ACTIVE. This is a control-plane action allowing AD join configuration mutation, potentially enabling credential hijacking or domain redirection.

Narrative

{principal.name} has ARM write permission on ANF account {account.name} (Microsoft.NetApp/netAppAccounts/write) and can modify the Active Directory join configuration, potentially injecting a new AD credential or redirecting the domain join to an attacker-controlled domain.

Raw rule rules/explicit/azure-netapp.yaml

id: azure-netapp-account-write-ad-hijack
emits: CanModifyConfiguration
description: netAppAccounts/write permission on ANF account enables AD join configuration modification.
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Storage and node_type(?account) == FileStorage
- ?account.provider_type == 'Microsoft.NetApp/netAppAccounts'
- ?principal has EFFECTIVE Microsoft.NetApp/netAppAccounts/write at ?account scope (Owner, Contributor,
  or custom role with netAppAccounts/write)
emit:
  source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?account
  permissions:
  - Microsoft.NetApp/netAppAccounts/write
  conditions:
  - iam_permission
  state_logic: 'if a deny assignment covers netAppAccounts/write at effective scope: BLOCKED; else ACTIVE.
    This is a control-plane action allowing AD join configuration mutation, potentially enabling credential
    hijacking or domain redirection.'
  confidence: '0.88'
  derived_from:
  - ?principal HasPermission ?account
  false_positive_note: netAppAccounts/write grants control-plane mutation of activeDirectories configuration
    on the ANF account. This can be used to set up a new AD join (adding a ContainsCredential link to
    a new AccessKey) or redirect to an attacker-controlled domain. CanModifyConfiguration correctly captures
    the configuration-alteration capability; do NOT emit CanAdminister (requires full admin scope, not
    just AD config write).
  narrative: '{principal.name} has ARM write permission on ANF account {account.name} (Microsoft.NetApp/netAppAccounts/write)
    and can modify the Active Directory join configuration, potentially injecting a new AD credential
    or redirecting the domain join to an attacker-controlled domain.'