azure-siem-data-export-write

id: azure-siem-data-export-write
emits: CanModifyConfiguration
description: Create or modify a workspace data export rule (configuration change). Redirecting logs to
  an attacker-controlled sink requires CanExfiltrate on the sink itself, which is emitted by a separate
  rule (azure-siem-data-export-active-to-sink) when export is enabled AND sink is writable. This rule
  emits CanModifyConfiguration on the workspace to model configuration capability; exfiltration is gated
  by sink ownership.
match_effective_permission:
  action: Microsoft.OperationalInsights/workspaces/dataExports/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: LoggingService
  source: <principal>
  target: <Log Analytics workspace (LoggingService)>
  permissions:
  - Microsoft.OperationalInsights/workspaces/dataExports/write
  conditions:
  - resource_policy
  state_logic: "ACTIVE when the principal holds dataExports/write. The ability to create/modify an export\
    \ rule is CONDITIONAL(resource_policy) when sink write permission is unconfirmed \u2014 the rule can\
    \ be created but export may fail if the workspace's MI (used for export) lacks write on the sink.\
    \ BLOCKED if a deny assignment covers dataExports/write. Exfiltration requires a separate gate: sink\
    \ must be writable by the workspace MI, which is modeled by the azure-siem-data-export-active-to-sink\
    \ rule (emits CanExfiltrate on the sink when enabled=true and sink CanWrite is confirmed)."
  confidence: 0.88
  derived_from:
  - 'effective permission: Microsoft.OperationalInsights/workspaces/dataExports/write'
  false_positive_note: "CONFIGURATION CHANGE, NOT EXFILTRATION. This rule models write permission on the\
    \ export rule configuration. Actual data exfiltration requires TWO gates: (1) dataExports/write (this\
    \ rule), AND (2) write access to the export sink (storage account or event hub). A separate derived\
    \ rule (azure-siem-data-export-active-to-sink) emits CanExfiltrate targeting the sink directly when\
    \ both conditions are met (export enabled=true AND sink is writable). Only tables that support continuous\
    \ export are eligible; not all tables support dataExports. Existing export rules can be modified (change\
    \ sink) without creating a new one. The data exfiltration consequence is realized over time as logs\
    \ stream \u2014 not immediate."
  narrative: '{principal.name} can create or modify data export rules in Log Analytics workspace {target.name}
    (dataExports/write), changing which storage account or event hub receives the exported logs. Actual
    exfiltration is realized only if the export sink is writable by the workspace managed identity (separate
    gate).'