azure-siem-playbook-modify

id: azure-siem-playbook-modify
emits: CanModifyCode
description: Overwrite a Sentinel automation playbook's Logic App definition to inject attacker code that
  runs as the playbook's managed identity on the next incident trigger.
match:
- - principal: null
  - HasPermission
  - logicApp: null
where:
- node_type(?logicApp) == Workflow
- ?logicApp is a Sentinel automation playbook (referenced by at least one Microsoft.SecurityInsights/automationRules
  resource)
- ?principal has EFFECTIVE Microsoft.Logic/workflows/write on ?logicApp
emit:
  source_type: Identity
  target_type: Workflow
  source: <principal>
  target: <Sentinel playbook (Logic App Workflow node)>
  permissions:
  - Microsoft.Logic/workflows/write
  conditions:
  - trigger_exists
  - service_state
  state_logic: ACTIVE when the principal holds Microsoft.Logic/workflows/write on the Logic App AND the
    playbook has a managed identity (so can-execute-as fires downstream) AND a trigger path exists (active
    Sentinel automation rule that fires the playbook, OR the playbook has a Recurrence trigger). CONDITIONAL(trigger_exists)
    if no confirmed trigger (the modified playbook waits for the next Sentinel incident/alert or manual
    run). BLOCKED if a deny assignment covers workflows/write on the Logic App.
  confidence: 0.95
  derived_from:
  - 'effective permission: Microsoft.Logic/workflows/write on the Sentinel playbook Logic App'
  - 'azure/logicapps.yaml: azure-la-workflow-write-modifycode (same permission, Logic App target)'
  - 'can-execute-as.yaml: execute-as-via-code-modify: CanModifyCode(?p, ?playbook) + ExecutesAs(?playbook,
    ?mi) => CanExecuteAs(?p, ?mi)'
  - 'cicd-chains.yaml: cicd-modify-buildspec-executes-as (playbook is a Workflow Compute node; CITE, do
    not re-derive)'
  false_positive_note: "The key distinction: Microsoft.SecurityInsights/automationRules/write ALONE does\
    \ NOT yield CanModifyCode \u2014 it only redirects the Sentinel trigger routing. CanModifyCode requires\
    \ Microsoft.Logic/workflows/write on the Logic App resource itself. The collapse to CanExecuteAs is\
    \ owned by can-execute-as execute-as-via-code-modify (and cicd-chains cicd-modify-buildspec-executes-as);\
    \ do NOT re-derive CanExecuteAs here. The playbook MUST have a managed identity for the CanExecuteAs\
    \ chain to fire; if the playbook has no MI, this yields only workflow behavior modification (still\
    \ CanModifyCode but no MI token downstream). The trigger may be infrequent (only fires on specific\
    \ incident types) \u2014 emit ACTIVE only when an automation rule actively routes to this playbook\
    \ with a permissive enough condition that the attacker can cause it to fire, otherwise CONDITIONAL(trigger_exists)."
  narrative: '{principal.name} can overwrite the definition of Sentinel playbook {target.name} (Microsoft.Logic/workflows/write),
    injecting attacker-controlled actions that run as the playbook''s managed identity on the next incident
    trigger. can-execute-as execute-as-via-code-modify derives CanExecuteAs(MI) from CanModifyCode + ExecutesAs;
    cicd-chains cicd-modify-buildspec-executes-as also fires for this Workflow node.'