Derivation rules

assign/action on an MI + VMSS write => can attach/replace the identity the fleet runs as.

Attach a chosen MI to the fleet + drive instance refresh => execute as the attached MI.

Modify the fleet's code/config + it executes as an MI => execute as that MI.

Run-command on an instance that executes as an MI => execute as that MI.

Any code-exec primitive on a fleet that has an MI yields that MI's token from IMDS.

Executing as the fleet MI grants whatever RBAC that MI holds.

A Connected VNet peering that crosses Azure subscriptions (emitted from explicit azure-vnet-peering-record) extends network reachability AND establishes a cross-subscription trust boundary - a critical lateral-movement fact.

A Connected VNet peering that crosses Entra tenant boundaries (emitted from explicit azure-vnet-peering-record) extends network reachability AND establishes a cross-tenant trust boundary - a critical lateral-movement fact.

A CNAME or alias DNS record (in a public zone) pointing to a deprovisioned Azure resource enables subdomain takeover: an attacker can claim the target resource and inherit DNS resolution for the dangling name.

Write access to private DNS zone record sets lets an attacker create or modify records - enabling DNS hijack or redirect within linked VNets.

Write access to public DNS zone record sets lets an attacker create or modify A/CNAME/alias records - enabling DNS hijack, redirect, or dangling-record takeover.

An NSG effective inbound rule allowing a source of Internet or 0.0.0.0/0 on a specific port/range means that port is reachable from the internet at the network layer. Source is the NSG/Subnet (a Network node), target is the compute resource behind it.

A compute resource or load balancer with a public IP AND an NSG rule that allows inbound Internet/0.0.0.0/0 on a port is internet-exposed.

Write access to NSG security rules lets an attacker add an inbound allow rule (e.g., source=Any, port=*, action=Allow) to open previously blocked network paths.

Write access to the NSG object itself (create/replace) gives equivalent capability to rewrite all security rules, effectively bypassing any existing rule set.

Write access to Microsoft.Network/privateEndpoints lets an attacker create a new private endpoint connecting a sensitive PaaS resource (Storage, Key Vault, SQL, etc.) to an in-VNet IP address - enabling a foothold in the VNet to reach that resource via PrivateReachability without internet traversal.

Write access to VNet peerings lets an attacker create or modify peerings, extending network reachability from an attacker-controlled VNet into this VNet.

A private endpoint (emitted from explicit azure-vnet-private-endpoint-record) makes a PaaS service (Key Vault, Storage, SQL, Service Bus, etc.) reachable at a private VNet IP. Compute resources located in the endpoint's VNet (via LocatedIn edges) gain network-layer access to that service without traversing the internet.

Write access to route table routes lets an attacker add a UDR redirecting traffic through an attacker-controlled next hop (NVA) - enabling traffic interception.

Write access to the Virtual WAN or Virtual Hub object (virtualWans/write or virtualHubs/write, both included in Network Contributor) grants full control of the vWAN topology, all hub connections, route tables, gateways, and routing policy.

A principal with read access to ExpressRoute circuit authorizations can retrieve the authorization key in plaintext, enabling a gateway in a DIFFERENT subscription to connect to the same circuit, bridging network topologies and bypassing subscription boundaries.

An active ExpressRoute connection (expressRouteConnections, provisioningState=Succeeded) is an explicit routing fact: the Virtual Hub routes traffic to and from the on-premises network via the ExpressRoute circuit. NOTE - Semantic Extension: RoutesTo normally targets [Network, Subnet]. On-premises networks may not exist as discrete nodes in the collected inventory if they are not explicitly modeled as Network nodes. In this case, the target is the ExpressRoute Circuit (TransitGateway) representing the on-premises reachability point. The network-chains linchpin must handle TransitGateway targets of RoutesTo as a special case distinct from Network/Subnet targets, treating them as proxies for external networks.

Write access to hub VNet connections (hubVirtualNetworkConnections/write) lets an attacker attach a new spoke VNet to the hub, inserting an attacker-controlled VNet into the transit topology and gaining network-layer reach to all existing connected resources, or detach an existing spoke to disrupt connectivity.

Write access to hub route tables (hubRouteTables/write) lets an attacker inject custom routes redirecting spoke traffic through an attacker-controlled next hop (NVA/VM), enabling network interception or MitM within the vWAN transit topology.

Write access to hub routing intent policies (routingIntentPolicies/write) lets an attacker modify inter-hub and internet traffic routing, redirecting traffic flows through attacker-controlled firewalls or NVAs or disabling firewall inspection entirely.

An active hub VNet connection (hubVirtualNetworkConnections, provisioningState=Succeeded) is an explicit routing fact: the Virtual Hub routes traffic to and from the connected spoke VNet.

An active S2S VPN connection (vpnConnections, connectionStatus=Connected) is an explicit routing fact: the Virtual Hub routes traffic to and from the on-premises branch via the VPN tunnel.

A principal with read access to a hub VPN connection resource can retrieve the pre-shared key (PSK) in plaintext from the ARM GET response (sharedKey field). The PSK enables establishing a rogue S2S VPN tunnel to the same hub, granting network-layer transit reach to all connected spoke VNets.

An external CI system (GitHub Actions/GitLab CI/Azure DevOps) with an OIDC/WIF trust into a cloud role/SA can federate in as that identity; escalation roll-ups are federation-chains'.

Modify the buildspec/pipeline/runbook/template a runner executes, then run it, to execute as the runner's service identity.

Triggering a pipeline reaches each downstream stage runner it orchestrates; propagate CanTrigger to those runners.