azure-synapse-serverless-cetas-exfiltrate
CREATE EXTERNAL TABLE AS SELECT (CETAS) on the serverless SQL pool exports query results to an external storage location; if the workspace MI holds write access on attacker-controlled storage, data is exfiltrated.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?workspace) ==
AnalyticsService
?principal can execute CETAS via serverless SQL pool (Synapse Administrator or db_owner on Built-in pool)
?mi holds Storage Blob Data Contributor (or write equivalent) on an attacker-accessible external storage
emit
| source type | Identity |
|---|---|
| target type | Data |
| source | <principal> |
| target | <source datastore queried by CETAS> |
| permissions | Synapse RBAC: Synapse Administrator (CETAS on serverless pool) workspace MI Storage Blob Data Contributor on target |
| conditions | iam_permission network_reachability |
| state logic | ACTIVE when (a) the principal can run CETAS on the serverless pool AND (b) the workspace MI holds write on the target external location. CONDITIONAL(iam_permission) when the target storage write permission is unknown. If Managed VNet exfiltration protection is enabled, outbound to external storage is BLOCKED unless the target is an approved managed private endpoint. |
Narrative
{principal.name} can execute CETAS on the serverless SQL pool in workspace {workspace.name} to export query results from {datastore.name} to an external storage location (written by the workspace MI {mi.name}).
Raw rule rules/derived/azure/synapse.yaml
id: azure-synapse-serverless-cetas-exfiltrate
emits: CanExfiltrate
description: CREATE EXTERNAL TABLE AS SELECT (CETAS) on the serverless SQL pool exports query results
to an external storage location; if the workspace MI holds write access on attacker-controlled storage,
data is exfiltrated.
match:
- - principal: null
- CanReadData
- datastore: null
- - workspace: null
- ExecutesAs
- mi: null
where:
- node_type(?workspace) == AnalyticsService
- ?principal can execute CETAS via serverless SQL pool (Synapse Administrator or db_owner on Built-in
pool)
- ?mi holds Storage Blob Data Contributor (or write equivalent) on an attacker-accessible external storage
emit:
source_type: Identity
target_type: Data
source: <principal>
target: <source datastore queried by CETAS>
permissions:
- 'Synapse RBAC: Synapse Administrator (CETAS on serverless pool)'
- workspace MI Storage Blob Data Contributor on target
conditions:
- iam_permission
- network_reachability
state_logic: ACTIVE when (a) the principal can run CETAS on the serverless pool AND (b) the workspace
MI holds write on the target external location. CONDITIONAL(iam_permission) when the target storage
write permission is unknown. If Managed VNet exfiltration protection is enabled, outbound to external
storage is BLOCKED unless the target is an approved managed private endpoint.
derived_from:
- ?principal CanReadData ?datastore
- ?workspace ExecutesAs ?mi
false_positive_note: The CETAS write is performed by the workspace MI, not the submitting principal
directly; the workspace MI must hold write on the destination. With exfiltration protection (managed
VNet + data-exfiltration prevention enabled), arbitrary external write is blocked. Do NOT emit ACTIVE
when exfiltration protection is on without confirming the target is an approved endpoint.
narrative: '{principal.name} can execute CETAS on the serverless SQL pool in workspace {workspace.name}
to export query results from {datastore.name} to an external storage location (written by the workspace
MI {mi.name}).'