azure-siem-automation-rule-write

id: azure-siem-automation-rule-write
emits: CanModifyConfiguration
description: Modify Sentinel automation rules to suppress automated incident response or redirect handling
  to an attacker-controlled playbook.
match_effective_permission:
  action: Microsoft.SecurityInsights/automationRules/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: SecurityService
  source: <principal>
  target: <Sentinel automation rule (SecurityService)>
  permissions:
  - Microsoft.SecurityInsights/automationRules/write
  conditions: []
  state_logic: ACTIVE when the effective permission is confirmed. automationRules/write allows changing
    the trigger condition (severity, incident type filter), the action (suppress response, change playbook
    target, add/remove action), or disabling the rule entirely. BLOCKED if a deny assignment covers automationRules/write.
  confidence: 0.92
  derived_from:
  - 'effective permission: Microsoft.SecurityInsights/automationRules/write'
  false_positive_note: 'EVASION + PARTIAL EXECUTION (but NOT standalone execution path). automationRules/write
    allows redirecting a Sentinel automation rule to a different playbook. However, the attacker still
    needs Microsoft.Logic/workflows/write on the playbook itself to control the playbook code. automationRules/write
    alone only changes WHICH playbook fires (the trigger routing); it does NOT modify the playbook definition.
    Do NOT derive CanModifyCode or CanExecuteAs from automationRules/write alone. The evasion value is:
    disable automated response so incidents queue without being acted on (suppression), or redirect to
    an attacker-controlled playbook already under their control.'
  narrative: "{principal.name} can modify Sentinel automation rules in workspace {target.name} (Microsoft.SecurityInsights/automationRules/write),\
    \ suppressing automated incident response or redirecting triggers to a different playbook. This weakens\
    \ automated response \u2014 automationRules/write alone does NOT modify playbook code."