azure-snapshot-contains-secret
A snapshot of an OS-type disk inherits the OS-disk ContainsSecret classification when the source disk is identified.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?disk) ==
BlockStorage
?disk.osType in [Windows, Linux]
emit
| source type | Snapshot |
|---|---|
| target type | Secret |
| source | <snapshot created from ?disk> |
| target | ?secret |
| state logic | ACTIVE when the source disk is identified as containing secrets. Confidence equals source disk's ContainsSecret confidence (not amplified). |
Narrative
Snapshot {source.name} is a point-in-time copy of an OS disk; it inherits the credential content of its source disk and is equally exploitable via SAS export.
Raw rule rules/derived/azure/disks.yaml
id: azure-snapshot-contains-secret
emits: ContainsSecret
description: A snapshot of an OS-type disk inherits the OS-disk ContainsSecret classification when the
source disk is identified.
match:
- - disk: null
- ContainsSecret
- secret: null
where:
- node_type(?disk) == BlockStorage
- ?disk.osType in [Windows, Linux]
emit:
source_type: Snapshot
target_type: Secret
source: <snapshot created from ?disk>
target: ?secret
permissions: []
state_logic: ACTIVE when the source disk is identified as containing secrets. Confidence equals source
disk's ContainsSecret confidence (not amplified).
confidence: inherit from source disk's ContainsSecret confidence
derived_from:
- <disk.ContainsSecret edge_id>
false_positive_note: Only emit when snapshot.creationData.sourceUri resolves to a disk with a known
OS type and an existing ContainsSecret edge. If the source disk is a pure data disk (no osType), do
not propagate unless there is additional evidence of credential content.
narrative: Snapshot {source.name} is a point-in-time copy of an OS disk; it inherits the credential
content of its source disk and is equally exploitable via SAS export.