azure-vmss-extension-write

id: azure-vmss-extension-write
emits: CanModifyCode
match_effective_permission:
  action: Microsoft.Compute/virtualMachineScaleSets/extensions/write
  scope_type: resource|resourceGroup|subscription|mg
emit:
  source_type: Identity
  source: <principal>
  target: <scale set>
  permissions:
  - Microsoft.Compute/virtualMachineScaleSets/extensions/write
  escalation: Add/replace a CustomScript or RunCommand model extension that runs attacker code on every
    instance as the scale-set MI.
  false_positive_note: 'Auto-detonation depends on the upgrade policy: on a fleet with upgradePolicy.mode=Automatic
    or extension enableAutomaticUpgrade the extension applies to existing instances without any further
    attacker action (strongest primitive); otherwise it requires a reimage / rolling-upgrade / new-instance
    lever to apply on existing instances (new instances get it automatically). Azure Policy may deny specific
    extension types (e.g. CustomScript); if a matching deny policy applies, emit BLOCKED.'
  narrative: '{principal.name} can write a model extension on {vmss.name} (virtualMachineScaleSets/extensions/write),
    running code on every instance.'