Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Assigning a user-assigned MI to an ACR Task requires both tasks/write AND MI assign/action.
Attach a user-assigned managed identity to a Data Factory (factories/write + assign/action on the MI), binding a higher-privilege identity to the factory's pipeline runs.
Cluster-admin kubeconfig -> exec any pod -> execute as every pod workload identity (cluster-wide summary edge; per-pod edges from container-chains cluster-rbac-exec).
Node-level code execution (privileged pod, hostPID, DaemonSet exec) reaches the node IMDS and mints a token for the node system-assigned / kubelet MI.
runCommand grants cluster-wide kubectl exec; any pod's workload identity is reachable by exec-ing into the pod (container-chains cluster-rbac-exec).
managedClusters/agentPools/write + assign on a target MI allows swapping the kubelet MI, binding all nodes to a more-privileged identity.
Attach a user-assigned MI to an AML compute cluster/instance - future jobs run as the new MI.
Any code running on an AML compute node can mint the compute MI's token from IMDS - the MI credential is exposed to all job code.
Any code on an AML compute node can mint a bearer token for the compute MI via IMDS.
Create a new AML compute bound to a chosen user-assigned MI, then submit a job to it - execute as that MI.
Submit a job specifying identity.client_id to override the cluster-default MI with a chosen user-assigned MI for that run.
An attacker who can write an Application Gateway and pass a user-assigned MI can swap the gateway's identity, gaining that MI's Key Vault (and potentially broader) permissions.
Principal holds assign/action on a UAMI and deploymentScripts/write - can bind the UAMI to a new or existing deploymentScript, making it the script's execution identity.
Attach a user-assigned managed identity to an Automation Account (Azure PassRole analog); subsequent runbooks execute as that MI.
An Automation Account sandbox job executes as the bound managed identity; any code running in the sandbox can mint MI tokens from IMDS.
An Automation Account sandbox job exposes its bound MI's token to any code it runs via the IMDS endpoint.
Code executing in an Automation Account sandbox can retrieve a bearer token for the bound MI from IMDS.
Attach/swap a user-assigned MI on a Databricks Access Connector, giving all workspace clusters access to that MI via IMDS.
A cluster with a bound Access Connector MI leaks that MI's credential to any code running on it via IMDS.
Any code on a cluster with a bound MI can mint a bearer token for that MI via IMDS.
A principal that can CanExecuteAs the pipeline's service-connection identity, where that identity holds ARM Contributor/Owner at subscription scope, gains a foothold in that Azure subscription.
Reading a secret that is a credential for a more-privileged identity is escalation.
Attach a user-assigned managed identity to a Logic App (assign/action + workflows/write or sites/write).
Principal with full control of the MI ARM object (Managed Identity Contributor / Contributor / Owner at scope) can administer the user-assigned identity resource.
A host with a bound MI exposes that identity's bearer token credential via the IMDS / App Service identity endpoint to any code running inside it.