Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Config modification (startup command / app settings) on a site + the site runs as an MI => execute as that MI.
Code/config modification on a site + the site runs as an MI => execute as that MI (via the MSI token endpoint).
Publishing profile creds -> Kudu ZipDeploy/command API -> code in the worker -> execute as the site MI.
App Service site reachable from the public internet on its default/custom hostname or scm endpoint.
Invoke an HTTP-triggered function using a function/host key (or anonymous auth).
Invoke an HTTP-triggered function directly via the control-plane action, without ever listing a function key.
Companion to azure-appsvc-msi-token: the site exposes its bound MI's credential material via the MSI token endpoint reachable from in-worker code.
Any code in the app worker can mint a bearer token for each bound MI via the App Service MSI token endpoint.
Companion to azure-appsvc-publishxml: the site exposes its long-lived publishing-profile (SCM/FTP) credential via publishxml/action.
Principal with deployments/read can retrieve sensitive values (listKeys results, Key Vault references) stored in deployment output history.
A deployment at subscription/MG scope whose deploying principal already holds roleAssignments/write can create role assignments (including Owner) for any identity via the template.
Principal with deployments/write at any scope can submit a deployment template containing an inline deploymentScript with attacker-controlled scriptContent.
Principal with deployments/write can submit or re-run a deployment, triggering the current template (including any deploymentScript resources) to execute.
Principal holds assign/action on a UAMI and deploymentScripts/write - can bind the UAMI to a new or existing deploymentScript, making it the script's execution identity.
Principal with deploymentScripts/read can retrieve plaintext values from the script's environmentVariables array if credentials are passed inline.
Create or update a deploymentScript resource to run arbitrary PS/Bash as its attached UAMI.
Overwrite a template spec version to inject a deploymentScript into all deployments that reference it.
Full control of an Automation Account (Automation Contributor / Contributor / Owner).
Modify the identity block of an Automation Account via automationAccounts/write; enables identity swap (CanAttachIdentity-like escalation).
Attach a user-assigned managed identity to an Automation Account (Azure PassRole analog); subsequent runbooks execute as that MI.
Modify or replace Automation Account connections, including legacy RunAs service principal credentials.
Attach a privileged managed identity to a new or existing Automation Account and trigger a runbook - equivalent to creating a new workload bound to that identity.
Read Automation Credentials (username/password pairs) via automationAccounts/credentials/read; values require data-plane getProperties/action or runbook execution.
An Automation Account sandbox job executes as the bound managed identity; any code running in the sandbox can mint MI tokens from IMDS.
An Automation Account sandbox job exposes its bound MI's token to any code it runs via the IMDS endpoint.
An Automation Account with a legacy RunAs account exposes the RunAs service principal certificate to any runbook via Get-AutomationConnection.
Submit a runbook job targeting a Hybrid Runbook Worker Group; the runbook runs as LOCAL SYSTEM (or a stored credential) on the designated VM/on-prem host.
Code executing in an Automation Account sandbox can retrieve a bearer token for the bound MI from IMDS.
Start a runbook job in an Automation Account (cloud sandbox or hybrid worker).
Create or modify a recurring job schedule that starts a runbook in an Automation Account.
Upload a malicious PowerShell module or Python package to an Automation Account; existing runbooks that Import-Module/import it execute the injected code as the account MI.
Overwrite or create a runbook (PowerShell/Python) in an Automation Account; content executes as the account MI on next job.
Repoint the Automation Account's source control sync to an attacker-controlled repository; runbook code is replaced at next sync.
Read a plaintext (non-encrypted) Automation Variable directly from ARM; encrypted variables require runbook execution.
Write plaintext Automation Variables that runbooks read; enables behavior modification or credential injection into the execution sandbox.
An enabled Automation Account webhook with a public URI is internet-triggerable; any holder of the URI can start a runbook job.
Holder of a webhook URI (secret token in URL) can trigger a specific runbook job via HTTP POST without ARM RBAC.
Create a new webhook for any runbook via automationAccounts/webhooks/write; the attacker receives the webhook URI once and can trigger the runbook.
The B2C IEF Keyset Administrator can replace the signing keyset used by custom policies, enabling token forgery for all relying party applications.
B2C IEF Policy Administrator or Global Admin can upload/replace custom policy XML, effectively reconfiguring the entire authentication and federation pipeline.
A principal who can write B2C custom policy XML can inject a Technical Profile trusting an attacker-controlled OIDC/SAML IdP.