Derivation rules

Full control of a Service Bus namespace (Contributor / Owner at namespace scope; NOT Service Bus Data Owner which lacks ARM write).

Write access to Service Bus authorization rules allows creating a new Send-capable SAS rule, then calling listKeys to extract a connection string - a two-step credential escalation.

A Service Bus namespace with readable SAS keys exposes its connection-string credential to any principal with listKeys access.

Read the primary and secondary connection strings of a namespace-level SAS authorization rule via listKeys; the connection string grants the rule's claims (Send/Listen/Manage) data-plane-wide.

A Service Bus namespace with active SAS authorization rules embeds connection-string credentials usable at data-plane without Entra RBAC.

Write access to the namespace network rule set allows disabling the default deny action or removing IP/VNet filters, opening the data-plane to previously blocked sources.

A Service Bus namespace with publicNetworkAccess=Enabled and no restrictive IP filter is reachable from the internet; any holder of a valid SAS key or Entra token can connect from any IP.

Read the connection string of a queue-level SAS authorization rule; scoped to that queue only.

A Service Bus queue with active entity-level SAS authorization rules embeds queue-scoped connection-string credentials usable at data-plane without Entra RBAC.

A confirmed event-source binding from a Service Bus queue to a compute consumer (Azure Function serviceBusTrigger, Logic App connector, Container App KEDA scaler) - the Phase-10 binding fact.

Azure Service Bus Data Receiver role (or Data Owner) grants data-plane receive from a queue or subscription; messages may carry secrets.

Holding a SAS connection string with Listen rights grants data-plane receive from the scoped queue/subscription - messages may carry secrets.

Holding a SAS connection string with Send rights (obtained via CanReadSecret/listKeys) grants data-plane send to the scoped namespace/queue/topic - equivalent to the Entra Data Sender role but credential-based.

Azure Service Bus Data Sender role (or Data Owner) grants data-plane send to a queue or topic; the primary Phase-10 publish primitive fed to messaging-chains.

Read the connection string of a topic-level SAS authorization rule; scoped to that topic only.

A Service Bus topic with active entity-level SAS authorization rules embeds topic-scoped connection-string credentials usable at data-plane without Entra RBAC.

A confirmed event-source binding from a Service Bus topic subscription to a compute consumer - fan-out trigger fact.

Data-plane: an admin client cert/Entra admin can provision an app type and create an application, running attacker code.

Register an attacker application-type version and create/upgrade an app pointing at it -> attacker code runs in the cluster.

An MI-enabled SF application leaks a usable credential for its managed identity via the per-node localhost token service environment.

Azure PassRole analog for the SF application plane: assign/action on a user-assigned MI lets the principal pass that MI to a workload.

Code in a managed-identity-enabled SF service can mint a bearer token for the app's MI from the per-node localhost token service.

Attach a privileged user-assigned MI to a new/controlled SF app and deploy attacker code -> execute as the MI.

Admin client cert -> provision app + the app runs as an MI => execute as that MI.

Deploy/upgrade an SF app with attacker code + the app runs as an MI => execute as that MI via the localhost token service.

SF cluster gateway (19000 FabricGateway / 19080 FabricHttpGateway+SFX) fronted by a public LB with a permissive NSG.

The cluster admin client certificate stored in Key Vault yields data-plane admin over the cluster.

Delete Sentinel analytics rules to silence specific threat detections (defense evasion - disable alerting for attack techniques).

Disable or modify Sentinel analytics rules to suppress alerts for specific TTPs (defense evasion).

Modify Sentinel automation rules to suppress automated incident response or redirect handling to an attacker-controlled playbook.

Delete a Sentinel data connector to stop ingestion from a specific data source, creating a blind spot.

Create or modify a workspace data export rule (configuration change). Redirecting logs to an attacker-controlled sink requires CanExfiltrate on the sink itself, which is emitted by a separate rule (azure-siem-data-export-active-to-sink) when export is enabled AND sink is writable. This rule emits CanModifyConfiguration on the workspace to model configuration capability; exfiltration is gated by sink ownership.

Overwrite a Sentinel automation playbook's Logic App definition to inject attacker code that runs as the playbook's managed identity on the next incident trigger.

Full control of a Log Analytics workspace (Log Analytics Contributor / Contributor / Owner).

Delete a Log Analytics workspace, destroying all ingested log evidence (defense evasion - cover tracks). Soft-delete for 14 days unless purge is forced. This is resource destruction (CanDelete), not data-row deletion (CanDeleteData). CanDeleteData target set [Storage, Data] excludes LoggingService (ManagementService), so CanDelete (target=*) is semantically correct for resource-level destruction.

Purge specific log data from a Log Analytics workspace (irreversible - targeted evidence destruction). The purge/action operation is data-plane irreversible row deletion within an existing workspace (distinct from workspaces/delete which destroys the workspace resource). CanDeleteData target set [Storage, Data] excludes LoggingService (ManagementService), so CanDelete (target=*) is the correct fallback to model data-plane row deletion capability.

Execute KQL queries against a Log Analytics workspace, reading ingested log data that may contain tokens, connection strings, API keys, or session credentials. Modeled as CanRead (target: LoggingService) - CanReadData target set is restricted to Storage/Data/Messaging and does not include ManagementService subtypes.

Modify Log Analytics workspace configuration (pricing tier, daily cap, retention) to halt or reduce log ingestion silently.

Wildcard permission on snapshots grants full control of the snapshot resource.

An attacker who can SAS-export a CMK-encrypted snapshot downloads encrypted blobs; plaintext read requires decrypt on the wrapping DES key (CONDITIONAL). When the same principal also holds CanDecrypt on the DES Key Vault key the decrypt-gates-secret-read rule in credential-chains.yaml upgrades to ACTIVE.

A snapshot of an OS-type disk inherits the OS-disk ContainsSecret classification when the source disk is identified.

An attacker who can SAS-export a PMK-encrypted or unencrypted snapshot can read the plaintext data immediately upon download (no key gate).