Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Register a malicious custom Docker environment image; when a job references it, the attacker container runs as the cluster MI.
Principal can trigger an existing AML job/pipeline run, executing the current job definition as the cluster MI.
Submit a training/pipeline/AutoML job whose command or script runs on the cluster as the compute MI.
Overwrite a notebook on the workspace file share (via storage write); the notebook runs on a compute instance as the compute MI.
Replace an online endpoint deployment's scoring script / model / environment; code executes as the endpoint MI on each inference request.
Retrieve the API key for a key-authenticated online endpoint via listkeys/action; required to invoke public endpoints.
AML online endpoint with a public HTTPS URL and key-based auth is reachable from the internet; the scoring key is retrievable via listkeys.
Submit a job specifying identity.client_id to override the cluster-default MI with a chosen user-assigned MI for that run.
AML workspace with publicNetworkAccess=Enabled exposes its management REST API to the internet - any token holder can reach it.
Owner / User Access Administrator on the AML workspace or compute scope can grant AML roles to any principal, including itself.
Principal can create or update job schedules that periodically trigger pipeline or training jobs on AML compute.
Full ARM control of the AML workspace grants administrative authority over all compute, jobs, datastores, and linked services.
A listKeys holder uses the access-key connection string to read every secret key-value, bypassing data-plane RBAC.
App Configuration Data Owner (*/read incl. keyValues/read) can read a secret key-value.
App Configuration Data Reader (keyValues/read) can read a key-value that holds credential material.
Writing a key-value can poison config a downstream app trusts (e.g. swap a connection string endpoint).
A principal with listKeys/action obtains the store's access-key connection strings (unless local auth is disabled).
snapshots/read returns the key-values frozen in a snapshot, including secret ones.
Holding Microsoft.Network/applicationGateways/* grants full control of an Application Gateway including routing rules, SSL certs, WAF policy, and backend pools.
An attacker who can write an Application Gateway and pass a user-assigned MI can swap the gateway's identity, gaining that MI's Key Vault (and potentially broader) permissions.
An Application Gateway with a public frontend IP accepts HTTP/HTTPS traffic from the internet on its listener ports.
Deleting a WAF policy detaches it from all associated Application Gateways, removing all L7 filtering and reverting those gateways to Standard_v2 (WAF-less) behavior.
Writing a WAF policy on an Application Gateway allows switching the policy from Prevention to Detection mode (allowing all attacks through) or disabling managed rule sets, weakening L7 security for all backends behind the gateway.
Writing an Application Gateway allows an attacker to redirect routing rules to attacker-controlled backends, swap SSL certificates, or modify the WAF policy binding - all without touching the backend VMs.
Companion to azure-appsvc-config-list: the site exposes cleartext app-settings / connection-string secrets via config/list/action.
Attach a privileged user-assigned MI to a site the attacker can already run code on, then execute as that MI. This is an existing-site chain (CanExecuteAs), NOT a create-new-workload chain.