Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
databaseAccounts/write allows modifying account properties (disableLocalAuth, firewall, CMK) - enabling configuration attacks such as re-enabling key auth or firewall bypass.
Cosmos DB account with firewall restricted to 0.0.0.0 (all Azure IPs) - accessible from any Azure-hosted workload but not the open internet.
Data read on CMK-encrypted Cosmos DB account - BLOCKED state when the Key Vault key is revoked or disabled.
Cosmos DB Built-in Data Contributor (or custom role with items/*) grants data-plane write - enabling item creation, replacement, upsert, and deletion.
Cosmos DB Built-in Data Reader (or custom role with items/read + executeQuery) grants effective data-plane read of items and query execution.
listConnectionStrings/action returns connection strings embedding the Cosmos DB master keys - equivalent credential exposure to listKeys.
listConnectionStrings/action returns connection strings embedding full master keys - equivalent complete data exfiltration as listKeys.
listKeys/action returns Cosmos DB master keys, bypassing all data-plane RBAC and network controls.
listKeys/action returns full master keys enabling complete data exfiltration (read/write/delete all items across all databases and containers).
Cosmos DB account with no IP firewall and public network access enabled exposes its data-plane endpoint to the internet - any caller with a valid token can reach it.
Read-only keys (from readonlykeys/action) enable read-only data exfiltration across all databases and containers.
readonlykeys/action returns Cosmos DB read-only master keys - bypasses data-plane RBAC for read operations across all databases and containers.
sqlRoleAssignments/write allows modifying Cosmos DB's native data-plane RBAC policy via role assignment creation/updates - enabling privilege escalation by assigning high-privilege roles to oneself.
Attach/swap a user-assigned MI on a Databricks Access Connector, giving all workspace clusters access to that MI via IMDS.
Cluster create/edit permission allows modifying Spark configuration (MI binding, credential passthrough, init scripts).
A cluster with a bound Access Connector MI leaks that MI's credential to any code running on it via IMDS.
Any code on a cluster with a bound MI can mint a bearer token for that MI via IMDS.
Cluster init scripts run as root before user code; write access to the init-script URI + cluster edit = code injection on every node.
Cluster policy write/admin allows loosening security constraints on cluster creation (init scripts, credential passthrough, unconstrained Spark conf).
Creating a Delta Sharing share with OPEN recipients produces publicly downloadable signed URLs for the shared data, enabling unauthenticated data exfiltration.
CAN_MANAGE on a Databricks job allows updating the job task definition (notebook, JAR, wheel, script, DLT pipeline), injecting attacker code.
CAN_MANAGE on a notebook path allows overwriting notebook code via import/overwrite; runs as the cluster MI on next execution.
CAN_MANAGE on a Delta Live Tables pipeline allows repointing the notebook/library source, injecting attacker code.
Databricks workspace REST API endpoint is publicly reachable; any token/PAT holder can authenticate from the internet.
MANAGE ACL on a Databricks secret scope allows granting READ/WRITE/MANAGE access to other principals and managing ACLs.
READ ACL on a Databricks secret scope allows reading its secrets via dbutils.secrets.get().
Admin role on a SQL Warehouse allows running arbitrary SQL queries that execute as the warehouse MI.
MANAGE privilege on a Unity Catalog object (catalog/schema/table/storage credential) allows granting access to other principals, including self.
SELECT privilege on a Unity Catalog table/schema/catalog grants data-plane read access to the underlying data.