services / Azure / Azure Firewall

Azure Firewall is a managed, stateful network firewall appliance that filters and inspects traffic for a virtual network, enforcing network/application/NAT rule collections and threat intelligence.

Acts as a network-perimeter defense for a single organizational function; its configuration reveals defensive posture and it can record in-transit traffic.

Microsoft.​Network/​azureFirewalls/​packetCapture/​action

Triggering a packet capture records live network traffic traversing the firewall to a capture file, allowing an attacker to capture and exfiltrate sensitive in-transit data and credentials.

Risks

1. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links