Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Replace a Web ACL with an attacker-controlled permissive one to weaken HTTP-layer filtering (requires owning a substitute Web ACL).
Modify an IP Set to add attacker-controlled IPs to allow lists or remove blocking IPs (defense evasion with blast radius tied to referencing Web ACLs).
Modify a Regex Pattern Set to remove blocking patterns or add permissive ones (defense evasion with blast radius tied to referencing Web ACLs).
Update or disassociate a Web ACL to weaken or remove HTTP-layer filtering from protected resources (defense evasion, not access grant).
Deploy a NEW container group with a privileged user-assigned MI attached, run it, and execute as the MI.
exec in a container + its group runs as an MI => execute as that MI (via IMDS/env token).
write (recreate) a container group that already runs as an MI => execute as that MI.
Container group with a public IP and exposed ports.
A container group with a bound managed identity leaks that MI's credential to any in-container code via the local IMDS/IDENTITY_ENDPOINT - the credential-leak fact paired with azure-aci-imds-token.
Any code in a container group can mint a bearer token for each bound managed identity (Linux IMDS, Windows IDENTITY_ENDPOINT).
anonymousPullEnabled == true on a registry makes image pull accessible to any unauthenticated client from the internet.
Full control of the registry (write + all sub-resource management).
importImage/action copies an external image into a registry tag - supply-chain write equivalent to AcrPush.
registries/listCredentials/action allows a principal to retrieve the admin account's long-lived passwords.
AcrPush (registries/push/write) over the registry - supply-chain primitive consumed by container-chains.
registries/write changes admin account state, trust policy, anonymous pull, network rules - alters the security posture of the entire registry.
scopeMaps/write allows a principal to modify repository-scoped token access policies, upgrading restricted tokens to include push/write capability.
Assigning a user-assigned MI to an ACR Task requires both tasks/write AND MI assign/action.
registries/taskRuns/write queues a manual run of an existing ACR Task - triggers execution of whatever the current task definition specifies as the task's MI.
tasks/write over an ACR Task - modifies build steps (the BuildWorker's code) that run as the task's MI.
tokens/listPasswords/action returns long-lived passwords for a repository-scoped token - principal can retrieve static credential valid for the actions in the token's scope map.
Attach a user-assigned managed identity to a Data Factory (factories/write + assign/action on the MI), binding a higher-privilege identity to the factory's pipeline runs.
Full control of an ADF factory (Data Factory Contributor / Contributor / Owner).
ADF Copy activity configured with an external or cross-boundary sink (HTTP, public blob, SFTP) can move data outside the authorized boundary.
Directly trigger a pipeline run via pipelines/createRun/action (requires Contributor/Owner or a custom role - NOT Data Factory Contributor).
Overwrite an ADF Data Flow definition to inject attacker transformation logic running on the factory's Spark/IR cluster as the factory MI.
An ADF factory with publicNetworkAccess=Enabled exposes its REST data-plane endpoint (adfstudio.azure.com + management.azure.com) to the internet.
Modify factory-level config (identity block, Git integration, public network access) via factories/write.
Obtain a short-lived ADF data-plane access token (getDataPlaneAccess/action) scoped to factory Author/Monitor/DataAccess operations.
Modify an ADF Integration Runtime configuration to swap SHIR VM assignment, reconfigure managed VNet, or change IR type - enables command execution or data exfiltration via network steering.
An ADF linked service stores a long-lived embedded credential (connection string, storage key, SP secret) exposed to pipeline runs.
Read an ADF linked service definition that contains inline connection string, storage key, SP client secret, or password.
Overwrite a linked service definition to inject attacker-controlled credentials or an attacker data source endpoint.
Retrieve authentication keys for linked services via listAuthKeys/action, directly accessing the plaintext credential without parsing typeProperties.
Read an ADF pipeline definition containing inline SAS URLs, API keys, or connection strings in activity url/body parameters.
Custom activities in ADF pipelines (running on Batch pools) can request a bearer token for the factory MI via the Azure IMDS endpoint.
Overwrite an ADF pipeline definition to inject arbitrary activities (Web, Custom, Copy) that run as the factory MI.
A Self-Hosted IR node VM stores encrypted linked service credentials in its local credential store; OS-level access to the node decrypts them.
An ADF Storage Events or Custom Events trigger binds a storage/Event Grid source to a pipeline; writing to that source drives the pipeline run.
Start a stopped ADF trigger to realize CONDITIONAL(trigger_exists) execution edges.
Create or modify an ADF trigger (Schedule / Tumbling Window) to fire pipelines autonomously as the factory MI - persistent execution.