diff --git a/docs/analyze-data/findings/table-view.mdx b/docs/analyze-data/findings/table-view.mdx index 8b809645..859ccfc3 100644 --- a/docs/analyze-data/findings/table-view.mdx +++ b/docs/analyze-data/findings/table-view.mdx @@ -86,8 +86,8 @@ flowchart LR subgraph active["Active findings"] direction TB - open["Open
No active acceptance"] - accepted["Accepted
Risk acceptance is active"] + open["Open
No active acceptance"] + accepted["Accepted
Risk acceptance is active"] open -->|"Accept risk"| accepted accepted -->|"Remove or expire
acceptance"| open end @@ -98,9 +98,9 @@ flowchart LR subgraph archived["System-archived outcomes"] direction TB systemChange{"System change"} - remediated["Remediated
Analysis no longer detects the finding"] - orphaned["Orphaned
Environment or OpenGraph extension
archived or removed"] - deprecated["Deprecated
Finding type removed from the schema"] + remediated["Remediated
Analysis no longer detects the finding"] + orphaned["Orphaned
Environment or OpenGraph extension
archived or removed"] + deprecated["Deprecated
Finding type removed from the schema"] systemChange --> remediated systemChange --> orphaned systemChange --> deprecated diff --git a/docs/resources/edges/az-add-members.mdx b/docs/resources/edges/az-add-members.mdx index 81d2dda2..cd76ec8c 100644 --- a/docs/resources/edges/az-add-members.mdx +++ b/docs/resources/edges/az-add-members.mdx @@ -1,6 +1,6 @@ --- title: AZAddMembers -description: "The ability to add other principals to an Azure security group" +description: "The ability to add principals to a security group in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-add-owner.mdx b/docs/resources/edges/az-add-owner.mdx index fa6eea5c..c1bf4ca3 100644 --- a/docs/resources/edges/az-add-owner.mdx +++ b/docs/resources/edges/az-add-owner.mdx @@ -1,6 +1,6 @@ --- title: AZAddOwner -description: "This edge is created during post-processing." +description: "This edge is created during post-processing to represent ownership over an object in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -46,7 +46,7 @@ New-AppOwner ` ``` ## Opsec Considerations -Any time you add an owner to any Azure object, the AzureAD audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was. +Any time you add an owner to any object, the audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was. ## References diff --git a/docs/resources/edges/az-add-secret.mdx b/docs/resources/edges/az-add-secret.mdx index 0557fcdb..2e2fb40d 100644 --- a/docs/resources/edges/az-add-secret.mdx +++ b/docs/resources/edges/az-add-secret.mdx @@ -1,6 +1,6 @@ --- title: AZAddSecret -description: Azure provides several systems and mechanisms for granting control of securable objects within Entra ID, including tenant-scoped admin roles, object-scoped admin roles, explicit object ownership, and API permissions. +description: "Azure provides several systems and mechanisms for granting control of securable objects within Entra ID, including tenant-scoped admin roles, object-scoped admin roles, explicit object ownership, and API permissions." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-aks-contributor.mdx b/docs/resources/edges/az-aks-contributor.mdx index c2d8de58..d229fc64 100644 --- a/docs/resources/edges/az-aks-contributor.mdx +++ b/docs/resources/edges/az-aks-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZAKSContributor -description: "The Azure Kubernetes Service Contributor role grants full control of the target Azure Kubernetes Service Managed Cluster." +description: "The Azure Kubernetes Service Contributor role in Azure Resource Manager grants full control of the target Azure Kubernetes Service managed cluster." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -47,6 +47,7 @@ If successful, the output will include a JWT for the managed identity service pr ## References +* [Azure Kubernetes Service Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/containers#azure-kubernetes-service-contributor-role) * [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) * [https://www.netspi.com/blog/technical/cloud-penetration-testing/extract-credentials-from-azure-kubernetes-service/](https://www.netspi.com/blog/technical/cloud-penetration-testing/extract-credentials-from-azure-kubernetes-service/) * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/) diff --git a/docs/resources/edges/az-authenticates-to.mdx b/docs/resources/edges/az-authenticates-to.mdx index 08f24618..132b8778 100644 --- a/docs/resources/edges/az-authenticates-to.mdx +++ b/docs/resources/edges/az-authenticates-to.mdx @@ -1,6 +1,6 @@ --- title: AZAuthenticatesTo -description: The AZAuthenticatesTo edge indicates that a Federated Identity Credential (FIC) is configured on an Azure App Registration, allowing an external identity provider to authenticate as the application without a password or certificate. +description: "The AZAuthenticatesTo edge indicates that a Federated Identity Credential (FIC) is configured on an application registration in Microsoft Entra ID, allowing an external identity provider to authenticate as the application without a password or certificate." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-automation-contributor.mdx b/docs/resources/edges/az-automation-contributor.mdx index 7647ee23..e6ed2e5e 100644 --- a/docs/resources/edges/az-automation-contributor.mdx +++ b/docs/resources/edges/az-automation-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZAutomationContributor -description: The Azure Automation Contributor role grants full control of the target Azure Automation Account. This includes the ability to execute arbitrary commands on the Automation Account. +description: "The Azure Automation Contributor role in Azure Resource Manager grants full control of the target Azure Automation account. This includes the ability to create and run a runbook that executes arbitrary commands in an Azure sandbox or on a configured Hybrid Runbook Worker." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -50,7 +50,8 @@ If successful, the output will include a JWT for the managed identity service pr -## References -* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) +## References +* [Automation Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#automation-contributor) +* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) * [https://specterops.io/blog/2022/06/06/managed-identity-attack-paths-part-1-automation-accounts/](https://specterops.io/blog/2022/06/06/managed-identity-attack-paths-part-1-automation-accounts/) * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/) diff --git a/docs/resources/edges/az-avere-contributor.mdx b/docs/resources/edges/az-avere-contributor.mdx index 1726f936..5e82dd7c 100644 --- a/docs/resources/edges/az-avere-contributor.mdx +++ b/docs/resources/edges/az-avere-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZAvereContributor -description: Any principal granted the Avere Contributor role, scoped to the affected VM, can reset the built-in administrator password on the VM. +description: "Any principal granted the Avere Contributor role in Azure Resource Manager, scoped to the affected VM, can reset the built-in administrator password on the VM." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -26,4 +26,4 @@ Because you’ll be running a command as the SYSTEM user on the Virtual Machine, * [https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/) * [https://attack.mitre.org/techniques/T1021/](https://attack.mitre.org/techniques/T1021/) -* [https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#avere-contributor](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#avere-contributor) +* [Avere Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#avere-contributor) diff --git a/docs/resources/edges/az-contains.mdx b/docs/resources/edges/az-contains.mdx index cfe9fc30..888d2480 100644 --- a/docs/resources/edges/az-contains.mdx +++ b/docs/resources/edges/az-contains.mdx @@ -1,6 +1,6 @@ --- title: AZContains -description: "This indicates that the parent object contains the child object, such as a resource group containing a virtual machine, or a tenant “containing” a subscription." +description: "This edge represents containment in Entra ID, or Azure Resource Manager hierarchy." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-contributor.mdx b/docs/resources/edges/az-contributor.mdx index f0e18776..a8d79060 100644 --- a/docs/resources/edges/az-contributor.mdx +++ b/docs/resources/edges/az-contributor.mdx @@ -1,18 +1,24 @@ --- title: AZContributor -description: "The contributor role grants almost all abusable privileges in all circumstances, with some exceptions. Those exceptions are not collected by AzureHound." +description: "An Entra principal has been granted the Azure Resource Manager 'Contributor' role over an Azure Resource Manager asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; import AzureGenericAbuseLogOpsec from '/snippets/edges/azure-generic-abuse-log-opsec.mdx'; - - - - -## Abuse Info - -This depends on what the target object is: + + +AZContributor targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "Contributor". + + + + +## Abuse Info + +The Contributor role grants broad management access to Azure Resource Manager resources, but it cannot assign Azure RBAC roles or perform the operations excluded by its `NotActions` list. + +Abuse depends on the target object: +The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies to that resource and, where applicable, its nested child resources. * **Key Vault:** You can read secrets and alter access policies (grant yourself access to read secrets) @@ -25,9 +31,10 @@ This depends on what the target object is: -## References - -* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) +## References + +* [Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#contributor) +* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) * [https://blog.netspi.com/azure-automation-accounts-key-stores/](https://blog.netspi.com/azure-automation-accounts-key-stores/) * [https://blog.netspi.com/get-azurepasswords/](https://blog.netspi.com/get-azurepasswords/) * [https://blog.netspi.com/attacking-azure-cloud-shell/](https://blog.netspi.com/attacking-azure-cloud-shell/) diff --git a/docs/resources/edges/az-execute-command.mdx b/docs/resources/edges/az-execute-command.mdx index 562460fb..f12920e4 100644 --- a/docs/resources/edges/az-execute-command.mdx +++ b/docs/resources/edges/az-execute-command.mdx @@ -1,6 +1,6 @@ --- title: AZExecuteCommand -description: "Principals with the Intune Administrators role are able to execute arbitrary PowerShell scripts on devices that are joined to the Azure tenant." +description: "Principals with the Intune Administrator role in Microsoft Entra ID can execute arbitrary PowerShell scripts on Windows devices enrolled in and managed through Intune." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-get-certificates.mdx b/docs/resources/edges/az-get-certificates.mdx index f5af016d..2bd8f401 100644 --- a/docs/resources/edges/az-get-certificates.mdx +++ b/docs/resources/edges/az-get-certificates.mdx @@ -1,6 +1,6 @@ --- title: AZGetCertificates -description: "The ability to read certificates from key vaults." +description: "The ability to read certificates from Azure Key Vault resources in Azure Resource Manager." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-get-keys.mdx b/docs/resources/edges/az-get-keys.mdx index dbf14420..93f53366 100644 --- a/docs/resources/edges/az-get-keys.mdx +++ b/docs/resources/edges/az-get-keys.mdx @@ -1,6 +1,6 @@ --- title: AZGetKeys -description: "The ability to read keys from key vaults." +description: "The ability to read keys from Azure Key Vault resources in Azure Resource Manager." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-get-secrets.mdx b/docs/resources/edges/az-get-secrets.mdx index fc1342e2..baf9e160 100644 --- a/docs/resources/edges/az-get-secrets.mdx +++ b/docs/resources/edges/az-get-secrets.mdx @@ -1,6 +1,6 @@ --- title: AZGetSecrets -description: "The ability to read secrets from key vaults." +description: "The ability to read secrets from Azure Key Vault resources in Azure Resource Manager." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-has-role.mdx b/docs/resources/edges/az-has-role.mdx index f807a213..6cf625a4 100644 --- a/docs/resources/edges/az-has-role.mdx +++ b/docs/resources/edges/az-has-role.mdx @@ -1,6 +1,6 @@ --- title: AZHasRole -description: The principal has an active assignment to the Entra ID role. This includes permanent assignments, and temporary assignments via Privileged Identity Management (PIM). If the principal is assigned eligibility via PIM the principal will also have an [AZRoleEligible](/resources/edges/az-role-eligible) edge to the role. +description: "The principal has an active assignment to the Entra ID role. This includes permanent assignments, and temporary assignments via Privileged Identity Management (PIM). If the principal is assigned eligibility via PIM the principal will also have an [AZRoleEligible](/resources/edges/az-role-eligible) edge to the role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-key-vault-contributor.mdx b/docs/resources/edges/az-key-vault-contributor.mdx index 0e06c0ee..681f27cb 100644 --- a/docs/resources/edges/az-key-vault-contributor.mdx +++ b/docs/resources/edges/az-key-vault-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZKeyVaultKVContributor -description: "The Key Vault Contributor role grants full control of the target Key Vault. This includes the ability to read all secrets stored on the Key Vault." +description: "The Key Vault Contributor role in Azure Resource Manager grants full control of the target Key Vault. This includes the ability to read all secrets stored on the Key Vault." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -24,6 +24,7 @@ Via PowerZure: ## References +* [Key Vault Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security#key-vault-contributor) * [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) * [https://blog.netspi.com/azure-automation-accounts-key-stores/](https://blog.netspi.com/azure-automation-accounts-key-stores/) * [https://blog.netspi.com/get-azurepasswords/](https://blog.netspi.com/get-azurepasswords/) diff --git a/docs/resources/edges/az-logic-app-contributor.mdx b/docs/resources/edges/az-logic-app-contributor.mdx index c7323225..d04e4826 100644 --- a/docs/resources/edges/az-logic-app-contributor.mdx +++ b/docs/resources/edges/az-logic-app-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZLogicAppContributor -description: The Logic Contributor role grants full control of the target Logic App. This includes the ability to execute arbitrary commands on the Logic App. +description: "The Logic Contributor role in Azure Resource Manager grants full control of the target Logic App. This includes the ability to execute arbitrary commands on the Logic App." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -18,8 +18,9 @@ You can see a full walkthrough for executing that abuse in this blog post: [And -## References - -* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) +## References + +* [Logic App Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/integration#logic-app-contributor) +* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) * [https://medium.com/p/52b29354fc54](https://medium.com/p/52b29354fc54) * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/) diff --git a/docs/resources/edges/az-managed-identity.mdx b/docs/resources/edges/az-managed-identity.mdx index d0e5ec8a..86350b6d 100644 --- a/docs/resources/edges/az-managed-identity.mdx +++ b/docs/resources/edges/az-managed-identity.mdx @@ -1,6 +1,6 @@ --- title: AZManagedIdentity -description: "Azure resources like Virtual Machines, Logic Apps, and Automation Accounts can be assigned to either System- or User-Assigned Managed Identities." +description: "Azure Resource Manager resources, such as virtual machines, Logic Apps, and Automation accounts, can be assigned system-assigned or user-assigned managed identities in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -10,7 +10,7 @@ import AzureGenericAbuseLogOpsec from '/snippets/edges/azure-generic-abuse-log-o - This assignment allows the Azure resource to authenticate to Azure services as the Managed Identity without needing to know the credential for that Managed Identity. Managed Identities, whether System- or User-Assigned, are AzureAD Service Principals. + This assignment allows the Azure resource to authenticate to Azure services as the Managed Identity without needing to know the credential for that Managed Identity. Managed Identities, whether System- or User-Assigned, are Service Principals. ## Abuse Info diff --git a/docs/resources/edges/az-member-of.mdx b/docs/resources/edges/az-member-of.mdx index 6558b937..ef15c944 100644 --- a/docs/resources/edges/az-member-of.mdx +++ b/docs/resources/edges/az-member-of.mdx @@ -1,6 +1,6 @@ --- title: AZMemberOf -description: "The given asset is a member of the group." +description: "The given Microsoft Entra ID asset is a member of the group." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-add-member.mdx b/docs/resources/edges/az-mg-add-member.mdx index 3cacc599..4f67fb1e 100644 --- a/docs/resources/edges/az-mg-add-member.mdx +++ b/docs/resources/edges/az-mg-add-member.mdx @@ -1,6 +1,6 @@ --- title: AZMGAddMember -description: "This edge is created during post-processing." +description: "The ability to add principals to the target security group in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-add-owner.mdx b/docs/resources/edges/az-mg-add-owner.mdx index 88f49598..7b07f704 100644 --- a/docs/resources/edges/az-mg-add-owner.mdx +++ b/docs/resources/edges/az-mg-add-owner.mdx @@ -1,6 +1,6 @@ --- title: AZMGAddOwner -description: "This edge is created during post-processing." +description: "The ability to add principals as owners of the target Microsoft Entra ID application, service principal, or security group." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -65,7 +65,7 @@ New-AppOwner ` ## Opsec Considerations -Any time you add an owner to any Azure object, the AzureAD audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was. +Any time you add an owner to any object, the audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was. ## References diff --git a/docs/resources/edges/az-mg-add-secret.mdx b/docs/resources/edges/az-mg-add-secret.mdx index 39fed961..f9427d6b 100644 --- a/docs/resources/edges/az-mg-add-secret.mdx +++ b/docs/resources/edges/az-mg-add-secret.mdx @@ -1,6 +1,6 @@ --- title: AZMGAddSecret -description: "This edge is created during post-processing." +description: "The ability to add a client secret to the target Microsoft Entra ID application or service principal." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx b/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx index ff0fc1b4..3e961e61 100644 --- a/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGAppRoleAssignment_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the AppRoleAssignment.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the AppRoleAssignment.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-application-readwrite-all.mdx b/docs/resources/edges/az-mg-application-readwrite-all.mdx index 3869b1b8..1e042cd6 100644 --- a/docs/resources/edges/az-mg-application-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-application-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGApplication_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the Application.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the Application.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-directory-readwrite-all.mdx b/docs/resources/edges/az-mg-directory-readwrite-all.mdx index 0653c542..7408db50 100644 --- a/docs/resources/edges/az-mg-directory-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-directory-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGDirectory_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the Directory.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the Directory.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-grant-app-roles.mdx b/docs/resources/edges/az-mg-grant-app-roles.mdx index a60f88ba..6de7d5ec 100644 --- a/docs/resources/edges/az-mg-grant-app-roles.mdx +++ b/docs/resources/edges/az-mg-grant-app-roles.mdx @@ -1,6 +1,6 @@ --- title: AZMGGrantAppRoles -description: "This edge is created during post-processing." +description: "The ability to grant Microsoft Entra ID app roles to service principals allows tenant compromise." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -8,7 +8,7 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; -It is created against AzureAD tenant objects when a Service Principal has one of the following MS Graph app role assignments: +It is created against tenant objects when a Service Principal has one of the following MS Graph app role assignments: * AppRoleAssignment.ReadWrite.All * RoleManagement.ReadWrite.Directory diff --git a/docs/resources/edges/az-mg-grant-role.mdx b/docs/resources/edges/az-mg-grant-role.mdx index 685bca40..ee3601c6 100644 --- a/docs/resources/edges/az-mg-grant-role.mdx +++ b/docs/resources/edges/az-mg-grant-role.mdx @@ -1,6 +1,6 @@ --- title: AZMGGrantRole -description: "This edge is created during post-processing." +description: "The ability to assign principals to the target Microsoft Entra ID administrative role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-group-member-readwrite-all.mdx b/docs/resources/edges/az-mg-group-member-readwrite-all.mdx index 3554927c..920fad6a 100644 --- a/docs/resources/edges/az-mg-group-member-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-group-member-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGGroupMember_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the GroupMember.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the GroupMember.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-group-readwrite-all.mdx b/docs/resources/edges/az-mg-group-readwrite-all.mdx index af7d8d2c..75127448 100644 --- a/docs/resources/edges/az-mg-group-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-group-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGGroup_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the Group.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the Group.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx b/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx index 3f783c77..39702d36 100644 --- a/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx +++ b/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx @@ -1,6 +1,6 @@ --- title: AZMGRoleManagement_ReadWrite_Directory -description: "This edge is created when a Service Principal has been granted the RoleManagement.ReadWrite.Directory edge." +description: "This edge is created when a service principal has been granted the RoleManagement.ReadWrite.Directory Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx b/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx index 4a6eb8fb..6ba784f4 100644 --- a/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGServicePrincipalEndpoint_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the ServicePrincipalEndpoint.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the ServicePrincipalEndpoint.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-node-resource-group.mdx b/docs/resources/edges/az-node-resource-group.mdx index c1103208..b77227a3 100644 --- a/docs/resources/edges/az-node-resource-group.mdx +++ b/docs/resources/edges/az-node-resource-group.mdx @@ -1,6 +1,6 @@ --- title: AZNodeResourceGroup -description: "This edge is created to link Azure Kubernetes Service Managed Clusters to the Virtual Machine Scale Sets they use to execute commands on." +description: "This Azure Resource Manager edge links Azure Kubernetes Service managed clusters to the virtual machine scale sets they use to execute commands." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-owner.mdx b/docs/resources/edges/az-owner.mdx index 90c9d56b..006ceb00 100644 --- a/docs/resources/edges/az-owner.mdx +++ b/docs/resources/edges/az-owner.mdx @@ -1,13 +1,15 @@ --- title: AZOwner -description: An Entra principal has been granted the Azure Resource Manager role called "Owner" over an Azure Resource Manager asset. +description: "An Entra principal has been granted the Azure Resource Manager 'Owner' role over an Azure Resource Manager asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; -AZOwner targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through role assignment called "Owner". +AZOwner targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "Owner". + +The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies to that resource and, where applicable, its nested child resources. The edges [AZOwner](/resources/edges/az-owner) and [AZOwns](/resources/edges/az-owns) are distinct as they each apply their own distinct identity and access management platform (AzureRM and Entra ID respectively) with distinct mechanics, abuse primitives, and remediation steps. @@ -19,7 +21,8 @@ Everything a Contributor can do, with the addition of assigning rights to resour This depends on which abuse you perform, but in general Azure will create a log for each abuse action. -## References - -* [https://blog.netspi.com/attacking-azure-with-custom-script-extensions/](https://blog.netspi.com/attacking-azure-with-custom-script-extensions/) +## References + +* [Owner](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#owner) +* [https://blog.netspi.com/attacking-azure-with-custom-script-extensions/](https://blog.netspi.com/attacking-azure-with-custom-script-extensions/) * [https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#owner](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#owner) diff --git a/docs/resources/edges/az-owns.mdx b/docs/resources/edges/az-owns.mdx index 5cecb1ad..da46c3b4 100644 --- a/docs/resources/edges/az-owns.mdx +++ b/docs/resources/edges/az-owns.mdx @@ -1,6 +1,6 @@ --- title: AZOwns -description: An Entra principal has been added as an owner over an Entra asset. +description: "A Microsoft Entra ID principal has been added as an owner over a Microsoft Entra ID asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-reset-password.mdx b/docs/resources/edges/az-reset-password.mdx index a638cb09..9df32758 100644 --- a/docs/resources/edges/az-reset-password.mdx +++ b/docs/resources/edges/az-reset-password.mdx @@ -1,6 +1,6 @@ --- title: AZResetPassword -description: "The ability to change another user’s password without knowing their current password." +description: "The ability to change another user’s password in Microsoft Entra ID without knowing their current password." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-role-approver.mdx b/docs/resources/edges/az-role-approver.mdx index 4c93dec5..8021fd65 100644 --- a/docs/resources/edges/az-role-approver.mdx +++ b/docs/resources/edges/az-role-approver.mdx @@ -1,6 +1,6 @@ --- title: AZRoleApprover -description: The principal is designated as an approver in the Privileged Identity Management (PIM) policy for the Entra ID role. PIM policies may require principals with the [AZRoleEligible](/resources/edges/az-role-eligible) edge to get approval from role approvers before activation takes effect. +description: "The principal is designated as an approver in the Privileged Identity Management (PIM) policy for the Entra ID role. PIM policies may require principals with the [AZRoleEligible](/resources/edges/az-role-eligible) edge to get approval from role approvers before activation takes effect." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-role-eligible.mdx b/docs/resources/edges/az-role-eligible.mdx index 7c78b4f0..78264e9a 100644 --- a/docs/resources/edges/az-role-eligible.mdx +++ b/docs/resources/edges/az-role-eligible.mdx @@ -1,6 +1,6 @@ --- title: AZRoleEligible -description: The principal is eligible for assignment to the Entra ID role via Privileged Identity Management (PIM). When the role is active the principal will also have an [AZHasRole](/resources/edges/az-has-role) edge to the role. +description: "The principal is eligible for assignment to the Entra ID role via Privileged Identity Management (PIM). When the role is active the principal will also have an [AZHasRole](/resources/edges/az-has-role) edge to the role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-runs-as.mdx b/docs/resources/edges/az-runs-as.mdx index 62f0e9b0..0a7b2a58 100644 --- a/docs/resources/edges/az-runs-as.mdx +++ b/docs/resources/edges/az-runs-as.mdx @@ -1,6 +1,6 @@ --- title: AZRunsAs -description: "The Azure App runs as the Service Principal when it needs to authenticate to the tenant." +description: "The application registration in Microsoft Entra ID runs as the service principal when it needs to authenticate to the tenant." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-scoped-to.mdx b/docs/resources/edges/az-scoped-to.mdx index 70b718e7..e06aa47f 100644 --- a/docs/resources/edges/az-scoped-to.mdx +++ b/docs/resources/edges/az-scoped-to.mdx @@ -1,6 +1,6 @@ --- title: AZScopedTo -description: "Is used to distinguish whether an EntraID (AzureAD) admin role such as Application Administrator or Cloud Application Administrator is scoped to the tenant or to a particular app registration or service principal." +description: "Distinguishes whether a Microsoft Entra ID admin role, such as Application Administrator or Cloud Application Administrator, is scoped to the tenant or to a particular application registration or service principal." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-user-access-administrator.mdx b/docs/resources/edges/az-user-access-administrator.mdx index ba41be1c..e7b12945 100644 --- a/docs/resources/edges/az-user-access-administrator.mdx +++ b/docs/resources/edges/az-user-access-administrator.mdx @@ -1,17 +1,23 @@ --- title: AZUserAccessAdministrator -description: "The User Access Admin role can edit roles against many other objects." +description: "An Entra principal has been granted the Azure Resource Manager 'User Access Administrator' role over an Azure Resource Manager asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; - - - - -## Abuse Info - -This role can be used to grant yourself or another principal any privilege you want against Automation Accounts, VMs, Key Vaults, and Resource Groups. For example, you can make yourself an administrator of an Azure Subscription by assigning the Owner role at the Subscription scope. + + +AZUserAccessAdministrator targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "User Access Administrator". + + + + +## Abuse Info + +The User Access Administrator role can manage access by assigning roles to principals within its scope. + +This role can be used to grant yourself or another principal any privilege you want against Automation Accounts, VMs, Key Vaults, and Resource Groups. For example, you can make yourself an administrator of an Azure Subscription by assigning the Owner role at the Subscription scope. +The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies to that resource and, where applicable, its nested child resources. The simplest way to execute this attack is to use the Azure portal to add a new, abusable role assignment against the target object for yourself. @@ -25,5 +31,6 @@ Using that token, you can make a call to the AzureRM API to create a new role as Azure will log any role activation event for any object type. -## References -* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) +## References +* [User Access Administrator](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#user-access-administrator) +* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) diff --git a/docs/resources/edges/az-vm-admin-login.mdx b/docs/resources/edges/az-vm-admin-login.mdx index 981f85e4..982fe150 100644 --- a/docs/resources/edges/az-vm-admin-login.mdx +++ b/docs/resources/edges/az-vm-admin-login.mdx @@ -1,6 +1,6 @@ --- title: AZVMAdminLogin -description: "When a virtual machine is configured to allow logon with Azure credentials, the VM automatically has certain principals added to its local administrators group, including any principal granted the Virtual Machine Administrator Login (or “VMAL”) admin role." +description: "When an Azure Resource Manager virtual machine is configured to allow sign-in with Microsoft Entra ID credentials, principals granted the Virtual Machine Administrator Login role are added to its local Administrators group." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -20,9 +20,10 @@ If the target computer is a workstation and a user is currently logged on, one o Remote desktop will create Logon and Logoff events with the access type RemoteInteractive. -## References - -* [https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/) +## References + +* [Virtual Machine Administrator Login](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/compute#virtual-machine-administrator-login) +* [https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/) * [https://attack.mitre.org/techniques/T1021/](https://attack.mitre.org/techniques/T1021/) * [https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows](https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows) * [https://specterops.io/blog/2022/08/03/introducing-bloodhound-4-2-the-azure-refactor/](https://specterops.io/blog/2022/08/03/introducing-bloodhound-4-2-the-azure-refactor/) diff --git a/docs/resources/edges/az-vm-contributor.mdx b/docs/resources/edges/az-vm-contributor.mdx index 659d087c..f250b532 100644 --- a/docs/resources/edges/az-vm-contributor.mdx +++ b/docs/resources/edges/az-vm-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZVMContributor -description: "The Virtual Machine contributor role grants almost all abusable privileges against Virtual Machines." +description: "The Virtual Machine Contributor role in Azure Resource Manager grants almost all abusable privileges against virtual machines." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -21,6 +21,7 @@ Via PowerZure: Because you’ll be running a command as the SYSTEM user on the Virtual Machine, the same opsec considerations for running malicious commands on any system should be taken into account: command line logging, PowerShell script block logging, EDR, etc. -## References - -* [https://blog.netspi.com/running-powershell-scripts-on-azure-vms/](https://blog.netspi.com/running-powershell-scripts-on-azure-vms/) +## References + +* [Virtual Machine Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/compute#virtual-machine-contributor) +* [https://blog.netspi.com/running-powershell-scripts-on-azure-vms/](https://blog.netspi.com/running-powershell-scripts-on-azure-vms/) diff --git a/docs/resources/edges/az-website-contributor.mdx b/docs/resources/edges/az-website-contributor.mdx index 25657361..52d869cf 100644 --- a/docs/resources/edges/az-website-contributor.mdx +++ b/docs/resources/edges/az-website-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZWebsiteContributor -description: "The Website Contributor role grants full control of the target Function App or Web App. Full control of either of those types of resources allows for arbitrary command execution against the target resoruce." +description: "The Website Contributor role in Azure Resource Manager grants full control of the target Function App or Web App. Full control of either resource allows arbitrary command execution against the target resource." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; @@ -53,9 +53,10 @@ If successful, the output will include a JWT for the managed identity service pr -## References - -* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) +## References + +* [Website Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/web-and-mobile#website-contributor) +* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) * [https://www.netspi.com/blog/technical/cloud-penetration-testing/lateral-movement-azure-app-services/](https://www.netspi.com/blog/technical/cloud-penetration-testing/lateral-movement-azure-app-services/) * [https://specterops.io/blog/2023/02/15/abusing-azure-app-service-managed-identity-assignments/](https://specterops.io/blog/2023/02/15/abusing-azure-app-service-managed-identity-assignments/) * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/) diff --git a/docs/resources/nodes/ad-local-group.mdx b/docs/resources/nodes/ad-local-group.mdx index d1d1ec62..71641536 100644 --- a/docs/resources/nodes/ad-local-group.mdx +++ b/docs/resources/nodes/ad-local-group.mdx @@ -1,5 +1,6 @@ --- title: ADLocalGroup +description: "The ADLocalGroup node represents a local group on a domain computer in Active Directory." icon: '/images/nodes/ad/ad-local-group.svg' --- @@ -42,4 +43,3 @@ The ADLocalGroup node represents a local group on a domain computer. | --- | --- | | **Edge type** | **Entity panel category** | | [LocalToComputer](/resources/edges/local-to-computer) | - | - diff --git a/docs/resources/nodes/az-app.mdx b/docs/resources/nodes/az-app.mdx index b163632e..ea5ca5ca 100644 --- a/docs/resources/nodes/az-app.mdx +++ b/docs/resources/nodes/az-app.mdx @@ -1,5 +1,6 @@ --- title: AZApp +description: "The AZApp node represents an application registration in Microsoft Entra ID." icon: '/images/nodes/azure/az-app.svg' --- diff --git a/docs/resources/nodes/az-automation-account.mdx b/docs/resources/nodes/az-automation-account.mdx index a40c513a..703fa521 100644 --- a/docs/resources/nodes/az-automation-account.mdx +++ b/docs/resources/nodes/az-automation-account.mdx @@ -1,5 +1,6 @@ --- title: AZAutomationAccount +description: "The AZAutomationAccount node represents an Azure Automation account in Azure Resource Manager." icon: '/images/nodes/azure/az-automation-account.svg' --- diff --git a/docs/resources/nodes/az-base.mdx b/docs/resources/nodes/az-base.mdx index a4c73be7..b701d61c 100644 --- a/docs/resources/nodes/az-base.mdx +++ b/docs/resources/nodes/az-base.mdx @@ -1,5 +1,6 @@ --- title: AZBase +description: "The AZBase node represents the basis for all other Microsoft Entra ID or Azure Resource Manager nodes." icon: '/images/nodes/azure/az-base.svg' --- diff --git a/docs/resources/nodes/az-container-registry.mdx b/docs/resources/nodes/az-container-registry.mdx index 6d8f1c3e..171f1122 100644 --- a/docs/resources/nodes/az-container-registry.mdx +++ b/docs/resources/nodes/az-container-registry.mdx @@ -1,5 +1,6 @@ --- title: AZContainerRegistry +description: "The AZContainerRegistry node represents an Azure Container Registry in Azure Resource Manager." icon: '/images/nodes/azure/az-container-registry.svg' --- diff --git a/docs/resources/nodes/az-device.mdx b/docs/resources/nodes/az-device.mdx index 7089b912..49456bb2 100644 --- a/docs/resources/nodes/az-device.mdx +++ b/docs/resources/nodes/az-device.mdx @@ -1,5 +1,6 @@ --- title: AZDevice +description: "The AZDevice node represents a device identity in Microsoft Entra ID." icon: '/images/nodes/azure/az-device.svg' --- diff --git a/docs/resources/nodes/az-federated-identity-credential.mdx b/docs/resources/nodes/az-federated-identity-credential.mdx index 0aa05f6f..0276fbd7 100644 --- a/docs/resources/nodes/az-federated-identity-credential.mdx +++ b/docs/resources/nodes/az-federated-identity-credential.mdx @@ -1,6 +1,6 @@ --- title: AZFederatedIdentityCredential -description: The AZFederatedIdentityCredential node represents a Federated Identity Credential (FIC) configured on an Azure App Registration, which allows an external identity provider to authenticate as the application without a password or certificate. +description: "The AZFederatedIdentityCredential node represents a Federated Identity Credential configured on an application registration in Microsoft Entra ID, which allows an external identity provider to authenticate as the application without a password or certificate." icon: '/images/nodes/azure/az-federated-identity-credential.svg' --- diff --git a/docs/resources/nodes/az-function-app.mdx b/docs/resources/nodes/az-function-app.mdx index cdbc8cb1..f865cada 100644 --- a/docs/resources/nodes/az-function-app.mdx +++ b/docs/resources/nodes/az-function-app.mdx @@ -1,5 +1,6 @@ --- title: AZFunctionApp +description: "The AZFunctionApp node represents an Azure Function App in Azure Resource Manager." icon: '/images/nodes/azure/az-function-app.svg' --- diff --git a/docs/resources/nodes/az-group.mdx b/docs/resources/nodes/az-group.mdx index 9e2feab5..0eb60de8 100644 --- a/docs/resources/nodes/az-group.mdx +++ b/docs/resources/nodes/az-group.mdx @@ -1,5 +1,6 @@ --- title: AZGroup +description: "The AZGroup node represents a group in Microsoft Entra ID." icon: '/images/nodes/azure/az-group.svg' --- diff --git a/docs/resources/nodes/az-key-vault.mdx b/docs/resources/nodes/az-key-vault.mdx index 305f7172..2098bb55 100644 --- a/docs/resources/nodes/az-key-vault.mdx +++ b/docs/resources/nodes/az-key-vault.mdx @@ -1,5 +1,6 @@ --- title: AZKeyVault +description: "The AZKeyVault node represents an Azure Key Vault in Azure Resource Manager." icon: '/images/nodes/azure/az-key-vault.svg' --- diff --git a/docs/resources/nodes/az-logic-app.mdx b/docs/resources/nodes/az-logic-app.mdx index c5ae8f42..611c62db 100644 --- a/docs/resources/nodes/az-logic-app.mdx +++ b/docs/resources/nodes/az-logic-app.mdx @@ -1,5 +1,6 @@ --- title: AZLogicApp +description: "The AZLogicApp node represents an Azure Logic App in Azure Resource Manager." icon: '/images/nodes/azure/az-logic-app.svg' --- diff --git a/docs/resources/nodes/az-managed-cluster.mdx b/docs/resources/nodes/az-managed-cluster.mdx index f4736f11..cedcf701 100644 --- a/docs/resources/nodes/az-managed-cluster.mdx +++ b/docs/resources/nodes/az-managed-cluster.mdx @@ -1,5 +1,6 @@ --- title: AZManagedCluster +description: "The AZManagedCluster node represents an Azure Kubernetes Service managed cluster in Azure Resource Manager." icon: '/images/nodes/azure/az-managed-cluster.svg' --- diff --git a/docs/resources/nodes/az-management-group.mdx b/docs/resources/nodes/az-management-group.mdx index de291b7c..036e51b8 100644 --- a/docs/resources/nodes/az-management-group.mdx +++ b/docs/resources/nodes/az-management-group.mdx @@ -1,5 +1,6 @@ --- title: AZManagementGroup +description: "The AZManagementGroup node represents an Azure management group in Azure Resource Manager." icon: '/images/nodes/azure/az-management-group.svg' --- diff --git a/docs/resources/nodes/az-resource-group.mdx b/docs/resources/nodes/az-resource-group.mdx index 12078ee6..a9a1eb30 100644 --- a/docs/resources/nodes/az-resource-group.mdx +++ b/docs/resources/nodes/az-resource-group.mdx @@ -1,5 +1,6 @@ --- title: AZResourceGroup +description: "The AZResourceGroup node represents an Azure resource group in Azure Resource Manager." icon: '/images/nodes/azure/az-resource-group.svg' --- diff --git a/docs/resources/nodes/az-role.mdx b/docs/resources/nodes/az-role.mdx index 4ed81c7b..4e7d0d15 100644 --- a/docs/resources/nodes/az-role.mdx +++ b/docs/resources/nodes/az-role.mdx @@ -1,5 +1,6 @@ --- title: AZRole +description: "The AZRole node represents a directory role in Microsoft Entra ID." icon: '/images/nodes/azure/az-role.svg' --- diff --git a/docs/resources/nodes/az-service-principal.mdx b/docs/resources/nodes/az-service-principal.mdx index 5a6fcea4..e6749fac 100644 --- a/docs/resources/nodes/az-service-principal.mdx +++ b/docs/resources/nodes/az-service-principal.mdx @@ -1,5 +1,6 @@ --- title: AZServicePrincipal +description: "The AZServicePrincipal node represents a service principal in Microsoft Entra ID." icon: '/images/nodes/azure/az-service-principal.svg' --- diff --git a/docs/resources/nodes/az-subscription.mdx b/docs/resources/nodes/az-subscription.mdx index d72f25ac..1c5996d6 100644 --- a/docs/resources/nodes/az-subscription.mdx +++ b/docs/resources/nodes/az-subscription.mdx @@ -1,5 +1,6 @@ --- title: AZSubscription +description: "The AZSubscription node represents an Azure subscription in Azure Resource Manager." icon: '/images/nodes/azure/az-subscription.svg' --- diff --git a/docs/resources/nodes/az-tenant.mdx b/docs/resources/nodes/az-tenant.mdx index 34433445..793d5539 100644 --- a/docs/resources/nodes/az-tenant.mdx +++ b/docs/resources/nodes/az-tenant.mdx @@ -1,5 +1,6 @@ --- title: AZTenant +description: "The AZTenant node represents a Microsoft Entra tenant." icon: '/images/nodes/azure/az-tenant.svg' --- diff --git a/docs/resources/nodes/az-user.mdx b/docs/resources/nodes/az-user.mdx index ede8a45e..3e497b8d 100644 --- a/docs/resources/nodes/az-user.mdx +++ b/docs/resources/nodes/az-user.mdx @@ -1,5 +1,6 @@ --- title: AZUser +description: "The AZUser node represents a user account in Microsoft Entra ID." icon: '/images/nodes/azure/az-user.svg' --- diff --git a/docs/resources/nodes/az-vm-scale-set.mdx b/docs/resources/nodes/az-vm-scale-set.mdx index 8ffe38a6..442ccd42 100644 --- a/docs/resources/nodes/az-vm-scale-set.mdx +++ b/docs/resources/nodes/az-vm-scale-set.mdx @@ -1,5 +1,6 @@ --- title: AZVMScaleSet +description: "The AZVMScaleSet node represents an Azure Virtual Machine Scale Set in Azure Resource Manager." icon: '/images/nodes/azure/az-vm-scale-set.svg' --- diff --git a/docs/resources/nodes/az-vm.mdx b/docs/resources/nodes/az-vm.mdx index b966db2d..aa94ba88 100644 --- a/docs/resources/nodes/az-vm.mdx +++ b/docs/resources/nodes/az-vm.mdx @@ -1,5 +1,6 @@ --- title: AZVM +description: "The AZVM node represents an Azure virtual machine in Azure Resource Manager." icon: '/images/nodes/azure/az-vm.svg' --- diff --git a/docs/resources/nodes/az-web-app.mdx b/docs/resources/nodes/az-web-app.mdx index 9dfb4b4e..42bd9038 100644 --- a/docs/resources/nodes/az-web-app.mdx +++ b/docs/resources/nodes/az-web-app.mdx @@ -1,5 +1,6 @@ --- title: AZWebApp +description: "The AZWebApp node represents an Azure Web App in Azure Resource Manager." icon: '/images/nodes/azure/az-web-app.svg' --- diff --git a/docs/resources/nodes/computer.mdx b/docs/resources/nodes/computer.mdx index 6df6f4ff..30594e20 100644 --- a/docs/resources/nodes/computer.mdx +++ b/docs/resources/nodes/computer.mdx @@ -1,5 +1,6 @@ --- title: Computer +description: "The Computer node represents a computer in Active Directory." icon: '/images/nodes/ad/computer.svg' --- diff --git a/docs/resources/nodes/container.mdx b/docs/resources/nodes/container.mdx index 4f601624..cffa8946 100644 --- a/docs/resources/nodes/container.mdx +++ b/docs/resources/nodes/container.mdx @@ -1,5 +1,6 @@ --- title: Container +description: "The Container node represents a container in Active Directory." icon: '/images/nodes/ad/container.svg' --- @@ -23,4 +24,3 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; * [https://learn.microsoft.com/en-us/windows/win32/adschema/c-container](https://learn.microsoft.com/en-us/windows/win32/adschema/c-container) - diff --git a/docs/resources/nodes/domain.mdx b/docs/resources/nodes/domain.mdx index 1f94b1b8..a13459ab 100644 --- a/docs/resources/nodes/domain.mdx +++ b/docs/resources/nodes/domain.mdx @@ -1,5 +1,6 @@ --- title: Domain +description: "The Domain node represents a domain in Active Directory." icon: '/images/nodes/ad/domain.svg' --- @@ -26,4 +27,3 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; ## References * [https://learn.microsoft.com/en-us/windows/win32/adschema/c-domain](https://learn.microsoft.com/en-us/windows/win32/adschema/c-domain)  - diff --git a/docs/resources/nodes/gpo.mdx b/docs/resources/nodes/gpo.mdx index de947d14..09b70672 100644 --- a/docs/resources/nodes/gpo.mdx +++ b/docs/resources/nodes/gpo.mdx @@ -1,5 +1,6 @@ --- title: GPO +description: "The GPO node represents a Group Policy Object in Active Directory." icon: '/images/nodes/ad/gpo.svg' --- @@ -27,4 +28,3 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; ## References * [https://learn.microsoft.com/en-us/windows/win32/adschema/c-grouppolicycontainer](https://learn.microsoft.com/en-us/windows/win32/adschema/c-computer) - diff --git a/docs/resources/nodes/group.mdx b/docs/resources/nodes/group.mdx index 9b40897f..e503571f 100644 --- a/docs/resources/nodes/group.mdx +++ b/docs/resources/nodes/group.mdx @@ -1,5 +1,6 @@ --- title: Group +description: "The Group node represents a group in Active Directory." icon: '/images/nodes/ad/group.svg' --- diff --git a/docs/resources/nodes/ou.mdx b/docs/resources/nodes/ou.mdx index 30b80196..ef6d147e 100644 --- a/docs/resources/nodes/ou.mdx +++ b/docs/resources/nodes/ou.mdx @@ -1,5 +1,6 @@ --- title: OU +description: "The OU node represents an organizational unit in Active Directory." icon: '/images/nodes/ad/ou.svg' --- diff --git a/docs/resources/nodes/user.mdx b/docs/resources/nodes/user.mdx index 2fc35b88..5cbdcfbc 100644 --- a/docs/resources/nodes/user.mdx +++ b/docs/resources/nodes/user.mdx @@ -1,5 +1,6 @@ --- title: User +description: "The User node represents a user account in Active Directory." icon: '/images/nodes/ad/user.svg' ---