azure-netapp-snapshot-exfiltrate

snapshots/write permission enables snapshot creation/restore, allowing within-subscription data exfiltration.

derived azure emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'volume': None} {'volume': None} Contains {'snapshot': None}

where

node_class(?volume) == Storage and node_type(?volume) == FileStorage ?volume.provider_type == 'Microsoft.NetApp/netAppAccounts/capacityPools/volumes' node_type(?snapshot) == Snapshot ?principal has EFFECTIVE Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/write at ?volume scope (Owner, Contributor, or custom role with snapshots/write) ?volume.properties.provisioningState == 'Succeeded' # volume is online

emit

source type	`Identity`
target type	`Snapshot`
source	`?principal`
target	`?snapshot`
permissions	`Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/write` `Microsoft.NetApp/netAppAccounts/capacityPools/volumes/write`
conditions	`iam_permission` `region_or_boundary`
state logic	if a deny assignment covers snapshots/write at effective scope: BLOCKED; elif a deny assignment covers volumes/write (required for restore to new volume): BLOCKED; elif ?snapshot exists and snapshots/write permission held: ACTIVE (principal can restore the snapshot to a new volume); elif no snapshots exist but snapshots/write + volumes/write permissions held: POTENTIAL (principal can CREATE a snapshot then restore it to a new volume); else: DO NOT EMIT. The region_or_boundary condition reflects that ANF snapshots are subscription-scoped; cross-subscription restore is NOT supported by Azure ANF. Exfiltration is within-subscription only.

Narrative

{principal.name} has ARM write permission on ANF volume {volume.name} snapshots (Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/write) and can create and restore snapshots to new volumes within the same subscription. This enables data exfiltration of the volume's contents to a different volume in the same subscription.

Raw rule rules/derived/azure/netapp.yaml

id: azure-netapp-snapshot-exfiltrate
emits: CanExfiltrate
description: snapshots/write permission enables snapshot creation/restore, allowing within-subscription
  data exfiltration.
match:
- - principal: null
  - HasPermission
  - volume: null
- - volume: null
  - Contains
  - snapshot: null
where:
- node_class(?volume) == Storage and node_type(?volume) == FileStorage
- ?volume.provider_type == 'Microsoft.NetApp/netAppAccounts/capacityPools/volumes'
- node_type(?snapshot) == Snapshot
- ?principal has EFFECTIVE Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/write at ?volume
  scope (Owner, Contributor, or custom role with snapshots/write)
- '?volume.properties.provisioningState == ''Succeeded''  # volume is online'
emit:
  source_type: Identity
  target_type: Snapshot
  source: ?principal
  target: ?snapshot
  permissions:
  - Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/write
  - Microsoft.NetApp/netAppAccounts/capacityPools/volumes/write
  conditions:
  - iam_permission
  - region_or_boundary
  state_logic: 'if a deny assignment covers snapshots/write at effective scope: BLOCKED; elif a deny assignment
    covers volumes/write (required for restore to new volume): BLOCKED; elif ?snapshot exists and snapshots/write
    permission held: ACTIVE (principal can restore the snapshot to a new volume); elif no snapshots exist
    but snapshots/write + volumes/write permissions held: POTENTIAL (principal can CREATE a snapshot then
    restore it to a new volume); else: DO NOT EMIT. The region_or_boundary condition reflects that ANF
    snapshots are subscription-scoped; cross-subscription restore is NOT supported by Azure ANF. Exfiltration
    is within-subscription only.'
  confidence: '0.72'
  derived_from:
  - ?principal HasPermission ?volume
  - ?volume Contains ?snapshot
  false_positive_note: 'snapshots/write grants ARM permission to create and restore snapshots on existing
    snapshots. CRITICAL: Azure ANF does NOT support cross-subscription snapshot restore or export. Snapshots
    are account/subscription-scoped. Snapshot restore to a new volume REQUIRES both snapshots/write (Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/write)
    AND volumes/write (Microsoft.NetApp/netAppAccounts/capacityPools/volumes/write) permissions to create
    the destination volume. Model as CanExfiltrate (identity -> snapshot) within subscription boundary
    only. Do NOT emit for cross-subscription restore (not an ANF capability). The subsequent restore-to-attacker-volume
    path is a separate derived rule (not implemented here), which would depend on volumes/write on the
    destination volume.'
  narrative: '{principal.name} has ARM write permission on ANF volume {volume.name} snapshots (Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/write)
    and can create and restore snapshots to new volumes within the same subscription. This enables data
    exfiltration of the volume''s contents to a different volume in the same subscription.'