Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Storage Blob Data Reader/Contributor/Owner grants effective data-plane read of ADLS Gen2 content.
Storage Blob Data Contributor/Owner grants effective data-plane write of ADLS Gen2 content.
generateUserDelegationKey/action allows minting user-delegation SAS tokens (Token credential type) for external distribution.
listKeys/action returns ADLS Gen2 account keys, bypassing all RBAC and ACLs.
Account key (from listKeys) grants full data-plane read and SAS generation - enabling complete data exfiltration.
ADLS Gen2 account with public blob access enabled and a public container exposes blob data to unauthenticated internet access.
Microsoft.ContainerService/managedClusters/* grants full control of the cluster (create/update/delete/stop/rotate/upgradeNodeImageVersion/etc.).
A cluster-admin kubeconfig (from listClusterAdminCredential) grants kubectl exec into any pod in the cluster.
Cluster-admin kubeconfig -> exec any pod -> execute as every pod workload identity (cluster-wide summary edge; per-pod edges from container-chains cluster-rbac-exec).
listClusterAdminCredential returns a static cluster-admin kubeconfig that bypasses AAD, giving unconditional cluster-admin access to the cluster.
listClusterUserCredential returns a user-level kubeconfig (AAD-token-gated, lower privilege), providing authenticated access to the cluster API server.
Node-level code execution (privileged pod, hostPID, DaemonSet exec) reaches the node IMDS and mints a token for the node system-assigned / kubelet MI.
Azure Kubernetes Service RBAC Cluster Admin role (Azure RBAC mode) maps to k8s cluster-admin, granting kubectl exec on every pod.
A principal with roleAssignments/write or Owner role can grant the Azure Kubernetes Service RBAC Cluster Admin role to any principal.
managedClusters/runCommand/action runs arbitrary kubectl/helm inside the cluster, bypassing network isolation; equivalent to cluster-wide kubectl exec.
runCommand grants cluster-wide kubectl exec; any pod's workload identity is reachable by exec-ing into the pod (container-chains cluster-rbac-exec).
runCommand/action can kubectl-apply attacker manifests - new/patched Deployments - changing what code runs as each workload identity.
managedClusters/agentPools/write + assign on a target MI allows swapping the kubelet MI, binding all nodes to a more-privileged identity.
managedClusters/write can disable local account restrictions, change the OIDC issuer, swap kubelet MI, or alter network egress - configuration changes that unlock or change escalation paths.
Submit a job to an AKS cluster attached as an AML compute target; the job runs inside the AKS cluster as a Kubernetes workload, enabling lateral movement to non-AML K8s resources.
Attach a user-assigned MI to an AML compute cluster/instance - future jobs run as the new MI.
Principal can invoke a batch endpoint to trigger a batch scoring job on the endpoint's compute cluster.
Overwrite a shared pipeline component definition; future pipeline jobs using that component run attacker code as the cluster MI.
Any code running on an AML compute node can mint the compute MI's token from IMDS - the MI credential is exposed to all job code.
Any code on an AML compute node can mint a bearer token for the compute MI via IMDS.
Write to a compute cluster - changes the compute identity block, SSH keys, subnet, or init scripts.
Write access to a compute instance can modify SSH public key configuration and other network settings.
SSH access to a running compute instance when SSH is enabled and the principal controls the SSH private key.
Retrieve workspace connection secrets (API keys for OpenAI, Cognitive Services, or custom REST endpoints) via connections/listsecrets.
Create a new AML compute bound to a chosen user-assigned MI, then submit a job to it - execute as that MI.
An AML datastore configured with accountKey/SAS/servicePrincipal credential exposes that credential to principals with listsecrets.
Retrieve stored datastore credentials (storage account key, SAS token, or SP client secret) via listsecrets.