azure-pl-pls-traffic-interception
When a consumer PE is Approved and connected to an attacker-controlled Private Link Service, network traffic from the consumer VNet is routed to the attacker's backend. This models the realized traffic-interception attack scenario (distinct from the write capability).
where
Private Link Service exists with properties.provisioningState == 'Succeeded'
A consumer PE connection to this PLS exists with status == 'Approved'
The PLS fronts an attacker-controlled backend (sourced from threat model or collection)
emit
| source type | Compute |
|---|---|
| target type | PrivateEndpoint |
| source | <Compute resources in the consumer VNet hosting the PE |
| target | <Private Link Service (fronting attacker backend)> |
| conditions | trigger_exists |
| state logic | CONDITIONAL(trigger_exists): traffic interception is realized only when a consumer PE is Approved and connects to the attacker-controlled PLS. Emit ACTIVE when an Approved consumer PE connection exists in inventory. If only the PLS exists but no consumer PE is Approved yet, emit POTENTIAL (attack requires getting a victim to connect). |
Narrative
Private Link Service {target.name} (fronting attacker backend) receives an Approved PE connection from consumer VNet {consumerVNet.name}. Traffic from that VNet is now routed to the attacker's backend - network MITM / credential harvesting.
Raw rule rules/derived/azure/privatelink.yaml
id: azure-pl-pls-traffic-interception
emits: PrivateReachability
description: When a consumer PE is Approved and connected to an attacker-controlled Private Link Service,
network traffic from the consumer VNet is routed to the attacker's backend. This models the realized
traffic-interception attack scenario (distinct from the write capability).
where:
- Private Link Service exists with properties.provisioningState == 'Succeeded'
- A consumer PE connection to this PLS exists with status == 'Approved'
- The PLS fronts an attacker-controlled backend (sourced from threat model or collection)
emit:
source_type: Compute
target_type: PrivateEndpoint
source: <Compute resources in the consumer VNet hosting the PE
target: <Private Link Service (fronting attacker backend)>
permissions: []
conditions:
- trigger_exists
state_logic: 'CONDITIONAL(trigger_exists): traffic interception is realized only when a consumer PE
is Approved and connects to the attacker-controlled PLS. Emit ACTIVE when an Approved consumer PE
connection exists in inventory. If only the PLS exists but no consumer PE is Approved yet, emit POTENTIAL
(attack requires getting a victim to connect).'
derived_from:
- <PLS provisioned + Approved consumer PE connection>
false_positive_note: This rule assumes the PLS backend is attacker-controlled. If the PLS legitimately
fronts a defender-controlled backend, this is not an attack edge. The separation of this rule from
azure-pl-pls-write clarifies that the control-plane capability is always ACTIVE but data-plane impact
is conditional.
narrative: "Private Link Service {target.name} (fronting attacker backend) receives an Approved PE connection\
\ from consumer VNet {consumerVNet.name}. Traffic from that VNet is now routed to the attacker's backend\
\ \u2014 network MITM / credential harvesting."