Derivation rules

A namespace or entity authorization rule with usable SAS keys (disableLocalAuth=false) embeds connection-string credential material; any holder of the keys can authenticate to the Event Hubs data plane.

Create a new event subscription on a topic or system topic, binding an event source to an attacker-controlled webhook endpoint.

A principal holding the domain access key can publish events to ALL topics within the Event Grid domain, triggering all subscribers across the domain.

Retrieve the domain access key from an Event Grid domain; the key enables publishing to ALL topics within the domain, triggering all their subscribers.

An Event Grid topic exposes its access key to any principal who can call listKeys/action; the key is a long-lived publish credential for the topic.

Retrieve the topic access key (aeg-sas-key) from an Event Grid custom topic; the key enables unlimited event publishing to the topic, triggering all subscribers.

Modifying Event Grid partner configurations authorizes an external partner to publish events into this subscription; a capability to alter subscription-level messaging trust.

A principal with the EventGrid Data Sender role (events/send/action) on a custom topic can publish events via Entra token, triggering all bound consumers.

A principal that holds the topic access key (retrieved via listKeys/action) can publish arbitrary events to the topic over HTTPS, triggering all bound consumers.

A principal with read access to an Event Grid subscription's dead-letter destination (Storage blob container) can read all failed/expired event payloads, including any credential material they contain.

Redirecting an event subscription's endpoint to an attacker-controlled webhook enables reading all event payloads from that topic (event exfiltration).

An active Event Grid event subscription binds a topic to a Compute consumer (Azure Function, Logic App, webhook); this is the CanTrigger fact consumed by messaging-chains rule 1.

Modify an existing event subscription's endpoint, redirecting all future events to an attacker-controlled webhook; enables event exfiltration and payload inspection.

Full control of an Event Grid topic (EventGrid Contributor / Contributor / Owner).

An Event Grid custom topic with publicNetworkAccess=Enabled is internet-accessible for event publishing (any holder of the topic key can publish from the internet).

When an Azure Firewall has active DNAT rules and a public IP allocated, resources translated by those rules are exposed to the internet via the firewall's public endpoint. This is emitted as internet exposure on the firewall node itself (as a Network class that has public reachability).

Azure Firewall DNAT rule (classic natRuleCollections model) is ingested as a synthetic Route node encoding (firewall_id, rule_name). The route is linked to the internal destination subnet via RoutesTo edge.

Azure Firewall Policy DNAT rule (firewallPolicies/ruleCollectionGroups model) is ingested as a synthetic Route node. The route is linked to the internal destination subnet via RoutesTo edge. Target is the Firewall that references this policy.

Write access to Firewall Policy rule collection groups allows an attacker to add or replace NAT, Network, or Application rule collection groups - inserting ALLOW or DNAT entries to open previously blocked network paths.

Write access to a Firewall Policy enables replacing or re-parenting the policy's basePolicy (policy hierarchy inheritance) or attaching the policy to additional Azure Firewalls, amplifying blast radius when a single policy controls multiple firewalls. This is a distinct capability from ruleCollectionGroups/write (which modifies rules only).

Write access to the Azure Firewall object (classic model) lets an attacker add or replace NAT, Network, or Application rule collections - inserting ALLOW rules or DNAT entries to open previously blocked network paths. When a Firewall Policy is attached, the classic inline rule collections become read-only (policy model takes precedence).

Write access to the AFD profile object (Microsoft.Cdn/profiles/*) grants full control: endpoints, origin groups, origins, security policies, WAF links, rule sets, and custom domains.

An enabled Azure Front Door endpoint (*.azurefd.net or a custom domain) is reachable from the public internet by design - AFD uses Microsoft's global anycast infrastructure; no explicit public IP is required on the profile. This is derived from the explicit normalization rule azure-frontdoor-endpoint-record.

Write access to AFD origin configuration (Microsoft.Cdn/profiles/originGroups/origins/write) lets an attacker replace an origin's hostname with an attacker-controlled server, causing AFD to forward real user requests (with authentication headers and session cookies) to attacker infrastructure.

An AFD Premium origin configured with a sharedPrivateLinkResource makes the target PaaS service reachable via a private endpoint inside the customer VNet. A compute foothold in the same VNet as the PE subnet can reach the same service privately (without traversing the internet).

An enabled AFD routing rule (route) linking a front door endpoint to an origin group with at least one enabled origin is a RoutesTo fact: the AFD route object (generic_type: Route, provider_type: Microsoft.Cdn/profiles/afdEndpoints/routes) routes matched internet requests to that origin resource. This is derived from the explicit normalization rule azure-frontdoor-origin-record.

Write access to AFD rule sets and rules (Microsoft.Cdn/profiles/ruleSets/rules/write) lets an attacker inject response headers (including Set-Cookie), perform request redirects to attacker-controlled URLs, and modify URL rewrites - all without touching origins or WAF.

Write access to the WAF policy object itself (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write) lets an attacker modify or delete managed rule sets and custom rules, effectively neutering WAF protections without touching the AFD profile or securityPolicies link.

Write access to AFD security policies (Microsoft.Cdn/profiles/securityPolicies/write) lets an attacker detach or replace the WAF policy linked to an AFD endpoint, removing bot protection, rate limiting, and custom detection rules from the public entry point.