azure-storage-file-data-reader

Storage File Data SMB Share Reader/Contributor grants SMB file share read access - enabling lateral movement and credential capture via shared files.

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'share': None}

where

node_class(?share) == Storage and node_type(?share) == FileStorage node_type(?share) matched provider_type == 'Microsoft.Storage/storageAccounts/fileServices/shares' ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/fileServices/shares/files/read at ?share scope (Storage File Data SMB Share Reader, Storage File Data SMB Share Contributor, or Storage File Data Privileged Reader)

emit

source typeIdentity
target typeFileStorage
source?principal
target?share
permissionsMicrosoft.Storage/storageAccounts/fileServices/shares/files/read
conditionsiam_permission network_reachability
state logicif networkAcls.defaultAction == Deny AND no allowed SMB/NFS path or PE: CONDITIONAL(network_reachability); elif deny assignment covers files/read at effective scope: BLOCKED; else ACTIVE. File share access is SMB/445 or NFS/2049 endpoint; data-plane firewall rules gate access identically to blob data.

Narrative

{principal.name} can read files from share {share.name} (Storage File Data SMB Share Reader or higher), enabling access to shared files that may contain cached credentials, scripts, or configuration material used for lateral movement.

Raw rule rules/derived/azure/storage.yaml

id: azure-storage-file-data-reader
emits: CanReadData
description: "Storage File Data SMB Share Reader/Contributor grants SMB file share read access \u2014\
  \ enabling lateral movement and credential capture via shared files."
match:
- - principal: null
  - HasPermission
  - share: null
where:
- node_class(?share) == Storage and node_type(?share) == FileStorage
- node_type(?share) matched provider_type == 'Microsoft.Storage/storageAccounts/fileServices/shares'
- ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/fileServices/shares/files/read
  at ?share scope (Storage File Data SMB Share Reader, Storage File Data SMB Share Contributor, or Storage
  File Data Privileged Reader)
emit:
  source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?share
  permissions:
  - Microsoft.Storage/storageAccounts/fileServices/shares/files/read
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'if networkAcls.defaultAction == Deny AND no allowed SMB/NFS path or PE: CONDITIONAL(network_reachability);
    elif deny assignment covers files/read at effective scope: BLOCKED; else ACTIVE. File share access
    is SMB/445 or NFS/2049 endpoint; data-plane firewall rules gate access identically to blob data.'
  confidence: '0.87'
  derived_from:
  - rule_id: azure-storage-file-read-permission
    binding: ?principal HasPermission ?share
  false_positive_note: "Azure Files support both SMB (Windows/Linux mount via 445) and NFS (Linux-native,\
    \ 2049). RBAC dataActions apply to both protocols. File shares may contain cached credentials, script\
    \ files with embedded keys, or shared config (.env, .ini). Apply ContainsSecret / ContainsCredential\
    \ on the share node when evidence indicates credential storage; credential-chains then handles the\
    \ escalation. Network gate applies identically to blob/queue: firewall rules block data-plane SMB\
    \ access but not ARM control-plane calls. Storage File Data Privileged Reader bypasses Windows file-level\
    \ ACLs (NTFS permissions) and NFS v4.1 ACLs on Azure Files shares \u2014 this is distinct from HNS\
    \ POSIX ACLs, which apply only to ADLS Gen2 blob storage, not to Azure Files."
  narrative: '{principal.name} can read files from share {share.name} (Storage File Data SMB Share Reader
    or higher), enabling access to shared files that may contain cached credentials, scripts, or configuration
    material used for lateral movement.'
move · open · esc close