azure-storage-file-data-reader
Storage File Data SMB Share Reader/Contributor grants SMB file share read access - enabling lateral movement and credential capture via shared files.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_class(?share) == Storage and node_type(?share) ==
FileStorage
node_type(?share) matched provider_type == 'Microsoft.Storage/storageAccounts/fileServices/shares'
?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/fileServices/shares/files/read at ?share scope (Storage File Data SMB Share Reader, Storage File Data SMB Share Contributor, or Storage File Data Privileged Reader)
emit
| source type | Identity |
|---|---|
| target type | FileStorage |
| source | ?principal |
| target | ?share |
| permissions | Microsoft.Storage/storageAccounts/fileServices/shares/files/read |
| conditions | iam_permission network_reachability |
| state logic | if networkAcls.defaultAction == Deny AND no allowed SMB/NFS path or PE: CONDITIONAL(network_reachability); elif deny assignment covers files/read at effective scope: BLOCKED; else ACTIVE. File share access is SMB/445 or NFS/2049 endpoint; data-plane firewall rules gate access identically to blob data. |
Narrative
{principal.name} can read files from share {share.name} (Storage File Data SMB Share Reader or higher), enabling access to shared files that may contain cached credentials, scripts, or configuration material used for lateral movement.
Raw rule rules/derived/azure/storage.yaml
id: azure-storage-file-data-reader
emits: CanReadData
description: "Storage File Data SMB Share Reader/Contributor grants SMB file share read access \u2014\
\ enabling lateral movement and credential capture via shared files."
match:
- - principal: null
- HasPermission
- share: null
where:
- node_class(?share) == Storage and node_type(?share) == FileStorage
- node_type(?share) matched provider_type == 'Microsoft.Storage/storageAccounts/fileServices/shares'
- ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/fileServices/shares/files/read
at ?share scope (Storage File Data SMB Share Reader, Storage File Data SMB Share Contributor, or Storage
File Data Privileged Reader)
emit:
source_type: Identity
target_type: FileStorage
source: ?principal
target: ?share
permissions:
- Microsoft.Storage/storageAccounts/fileServices/shares/files/read
conditions:
- iam_permission
- network_reachability
state_logic: 'if networkAcls.defaultAction == Deny AND no allowed SMB/NFS path or PE: CONDITIONAL(network_reachability);
elif deny assignment covers files/read at effective scope: BLOCKED; else ACTIVE. File share access
is SMB/445 or NFS/2049 endpoint; data-plane firewall rules gate access identically to blob data.'
confidence: '0.87'
derived_from:
- rule_id: azure-storage-file-read-permission
binding: ?principal HasPermission ?share
false_positive_note: "Azure Files support both SMB (Windows/Linux mount via 445) and NFS (Linux-native,\
\ 2049). RBAC dataActions apply to both protocols. File shares may contain cached credentials, script\
\ files with embedded keys, or shared config (.env, .ini). Apply ContainsSecret / ContainsCredential\
\ on the share node when evidence indicates credential storage; credential-chains then handles the\
\ escalation. Network gate applies identically to blob/queue: firewall rules block data-plane SMB\
\ access but not ARM control-plane calls. Storage File Data Privileged Reader bypasses Windows file-level\
\ ACLs (NTFS permissions) and NFS v4.1 ACLs on Azure Files shares \u2014 this is distinct from HNS\
\ POSIX ACLs, which apply only to ADLS Gen2 blob storage, not to Azure Files."
narrative: '{principal.name} can read files from share {share.name} (Storage File Data SMB Share Reader
or higher), enabling access to shared files that may contain cached credentials, scripts, or configuration
material used for lateral movement.'