azure-siem-data-export-active-to-sink
match (record)
{
"field": "properties.destination.resourceId",
"resource_type": "Microsoft.OperationalInsights/workspaces/dataExports"
}
where
properties.enabled == true
workspace MI (from workspace identity) has EFFECTIVE write access to the sink resource (storage account or event hub)
emit
| source type | Identity |
|---|---|
| target type | ObjectStorage |
| source | <workspace system-assigned MI or service principal used for the data export> |
| target | <export sink storage account (ObjectStorage) or event hub (EventBus)> |
| conditions | resource_policy |
| state logic | ACTIVE when the export rule is enabled (properties.enabled == true) AND the workspace identity (MI/SP) has confirmed write access to the sink (resource_policy condition: sink resource policy or RBAC grants write). CONDITIONAL(resource_policy) if sink write access is unconfirmed. This rule emits CanExfiltrate directly on the sink (target: ObjectStorage/EventBus), modeling that data egresses from the workspace to the sink when the export is active. |
Narrative
Log Analytics workspace data export continuously sends log data to {target.name} (ObjectStorage/EventBus). The workspace identity (MI/SP) has write access to the sink, enabling data exfiltration if an attacker can redirect or hijack the export (via dataExports/write + sink ownership). This rule is ACTIVE when export enabled=true and sink is writable by the workspace identity.
Raw rule rules/explicit/azure/loganalytics.yaml
id: azure-siem-data-export-active-to-sink
emits: CanExfiltrate
applies_to:
- azure
match_record:
resource_type: Microsoft.OperationalInsights/workspaces/dataExports
field: properties.destination.resourceId
where:
- properties.enabled == true
- workspace MI (from workspace identity) has EFFECTIVE write access to the sink resource (storage account
or event hub)
emit:
source_type: Identity
target_type: ObjectStorage
source: <workspace system-assigned MI or service principal used for the data export>
target: <export sink storage account (ObjectStorage) or event hub (EventBus)>
api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{workspace}/dataExports
evidence_field: properties.destination.resourceId + properties.enabled == true + confirmed workspace
MI CanWrite on sink
conditions:
- resource_policy
state_logic: 'ACTIVE when the export rule is enabled (properties.enabled == true) AND the workspace
identity (MI/SP) has confirmed write access to the sink (resource_policy condition: sink resource
policy or RBAC grants write). CONDITIONAL(resource_policy) if sink write access is unconfirmed. This
rule emits CanExfiltrate directly on the sink (target: ObjectStorage/EventBus), modeling that data
egresses from the workspace to the sink when the export is active.'
confidence: 0.92
derived_from:
- 'configuration: Microsoft.OperationalInsights/workspaces/dataExports enabled=true'
- 'structural: workspace MI/SP identity + sink write access (RBAC/policy)'
narrative: Log Analytics workspace data export continuously sends log data to {target.name} (ObjectStorage/EventBus).
The workspace identity (MI/SP) has write access to the sink, enabling data exfiltration if an attacker
can redirect or hijack the export (via dataExports/write + sink ownership). This rule is ACTIVE when
export enabled=true and sink is writable by the workspace identity.