azure-sql-mi-ltr-backup-exfiltrate

backupLongTermRetentionPolicies/write allows redirecting SQL MI database backups to an attacker-controlled storage account, enabling full database exfiltration outside the tenant.

derived azure emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'miDatabase': None}

where

node_type(?miDatabase) == RelationalDatabase ?miDatabase.provider_type == 'Microsoft.Sql/managedInstances/databases' ?principal has EFFECTIVE Microsoft.Sql/managedInstances/databases/backupLongTermRetentionPolicies/write at ?miDatabase scope (Owner, Contributor, SQL MI Contributor 4939a1f6-9ae0-4e48-a1e0-f2cbe897382d, or custom role with backupLongTermRetentionPolicies/write)

emit

source type	`Identity`
target type	`RelationalDatabase`
source	`?principal`
target	`?miDatabase`
permissions	`Microsoft.Sql/managedInstances/databases/backupLongTermRetentionPolicies/write`
conditions	`iam_permission`
state logic	if a deny assignment or deny Azure Policy covers backupLongTermRetentionPolicies/write at the effective scope: BLOCKED; else ACTIVE: the principal can modify the LTR backup policy, setting the storage account and credentials to redirect backups. By specifying a storage account the attacker controls (or has write access to), they can exfiltrate the full database backup (schema + data). This is an ARM control-plane call; it is NOT gated by the MI subnet NSG or network configuration. The backup job runs asynchronously under the MI's system-assigned MI, which must have write access to the specified storage account (via a storage key or SAS token provided in the policy).

Narrative

{principal.name} holds Microsoft.Sql/managedInstances/databases/backupLongTermRetentionPolicies/write on {miDatabase.name}, allowing it to modify the LTR backup policy and redirect backups to an attacker-controlled storage account. This enables exfiltration of the full database (schema and all data) outside the organization's tenant via the backup file.

Raw rule rules/derived/azure/sql.yaml

id: azure-sql-mi-ltr-backup-exfiltrate
emits: CanExfiltrate
description: backupLongTermRetentionPolicies/write allows redirecting SQL MI database backups to an attacker-controlled
  storage account, enabling full database exfiltration outside the tenant.
match:
- - principal: null
  - HasPermission
  - miDatabase: null
where:
- node_type(?miDatabase) == RelationalDatabase
- ?miDatabase.provider_type == 'Microsoft.Sql/managedInstances/databases'
- ?principal has EFFECTIVE Microsoft.Sql/managedInstances/databases/backupLongTermRetentionPolicies/write
  at ?miDatabase scope (Owner, Contributor, SQL MI Contributor 4939a1f6-9ae0-4e48-a1e0-f2cbe897382d, or
  custom role with backupLongTermRetentionPolicies/write)
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?miDatabase
  permissions:
  - Microsoft.Sql/managedInstances/databases/backupLongTermRetentionPolicies/write
  conditions:
  - iam_permission
  state_logic: 'if a deny assignment or deny Azure Policy covers backupLongTermRetentionPolicies/write
    at the effective scope: BLOCKED; else ACTIVE: the principal can modify the LTR backup policy, setting
    the storage account and credentials to redirect backups. By specifying a storage account the attacker
    controls (or has write access to), they can exfiltrate the full database backup (schema + data). This
    is an ARM control-plane call; it is NOT gated by the MI subnet NSG or network configuration. The backup
    job runs asynchronously under the MI''s system-assigned MI, which must have write access to the specified
    storage account (via a storage key or SAS token provided in the policy).'
  confidence: '0.94'
  derived_from:
  - <HasPermission edge_id (backupLongTermRetentionPolicies/write)>
  false_positive_note: "The LTR backup policy write permission is less commonly granted than database\
    \ export permission, but it is included in the Owner/Contributor roles at subscription or MI scope.\
    \ SQL Database (logical servers) also support automated backup retention, but the policy is managed\
    \ by Azure and not directly writable by principals \u2014 the primary exfiltration vector for SQL\
    \ Database is BACPAC export. For SQL MI, LTR policy write is a distinct exfiltration capability. Verify\
    \ that the principal actually has write access to the target storage account (or that they can specify\
    \ credentials/SAS tokens in the policy) to complete the exfiltration chain. The backup process itself\
    \ is asynchronous; the ARM permission is the gate."
  narrative: '{principal.name} holds Microsoft.Sql/managedInstances/databases/backupLongTermRetentionPolicies/write
    on {miDatabase.name}, allowing it to modify the LTR backup policy and redirect backups to an attacker-controlled
    storage account. This enables exfiltration of the full database (schema and all data) outside the
    organization''s tenant via the backup file.'