Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
A secret credential for a principal in another subscription yields entry there.
Reading a secret that is a credential for a more-privileged identity is escalation.
A vault self-grant equally yields decrypt/unwrap on every key in the vault.
A vault self-grant yields read of every secret/cert in the vault.
A vault self-grant equally yields sign on every signing-capable key in the vault.
Owner/User Access Admin self-assigns a Key Vault data-plane role (RBAC model).
Attach a user-assigned managed identity to a Logic App (assign/action + workflows/write or sites/write).
Obtain the SAS-signed HTTP trigger callback URL for a Logic App (listCallbackUrl/action).
An API connection referencing a resource in a different subscription (same tenant) represents cross-subscription exposure.
An API connection referencing a resource in a different Entra tenant represents cross-tenant credential trust.
An API connection stores a long-lived service credential (key/token) usable by any code that can call listConnectionKeys.
Full control of a Logic App workflow (Logic App Contributor / Contributor / Owner).
A Logic App with a public HTTP (Request) trigger and no IP allowlist is triggerable from the internet.
Invoke a Logic App HTTP trigger using a held callback URL (SAS-signed).
A Standard Logic App with a bound MI exposes that MI's credential to any code/action running in the app.
Code/actions in a Standard Logic App can mint a bearer token for each bound MI via the App Service identity endpoint.
List the embedded key/token for an API connection used by a Logic App (listConnectionKeys/action).
A Logic App with a Recurrence trigger fires autonomously on a cadence - creating/modifying it with workflows/write is schedule creation.
Read run-history expression traces containing secrets (API keys, connection strings, tokens) via listExpressionTraces/action.
Enable a disabled Logic App workflow to realize CONDITIONAL execution edges.
Read decrypted app settings and connection strings of a Standard Logic App (config/list/Action).
Modify app settings/config of a Standard Logic App (WEBSITE_RUN_FROM_PACKAGE / image / env / identity).
Deploy attacker code to a Standard Logic App via Kudu/SCM ZipDeploy (extensions/write).
Hijack the source control of a Standard Logic App to an attacker repo (sourcecontrols/Write).
Overwrite the Logic App workflow definition to inject arbitrary actions running as the workflow's MI.
Holding the Microsoft.Network/loadBalancers/* wildcard grants full control of a Standard Load Balancer.
Writing a Load Balancer backend address pool allows adding an attacker-controlled VM to the pool, routing a fraction of traffic to it for interception or amplification.
Creating or modifying an inbound NAT rule maps a public LB frontend port directly to a backend VM's port, potentially exposing SSH/RDP/admin ports to the internet.
A Standard Load Balancer with a public frontend IP is reachable from the internet on its listener ports.
Writing a Load Balancer resource allows adding a public frontend IP, new load-balancing rules, or inbound NAT rules that expose previously private ports.
A customer principal with Microsoft.ManagedServices/registrationDefinitions/write can modify Lighthouse trust anchors (authorizations list, managing tenant).
A customer principal with Microsoft.ManagedServices/registrationAssignments/write can create/modify Lighthouse registrationAssignments - enable cross-tenant access.
A managing-tenant ExternalPrincipal named in a resource-group-scoped Lighthouse authorization has CanAdminister over that resource group.