services / Azure / Virtual network gateway connection

A VirtualNetworkGatewayConnection links a virtual network gateway to a peer (another gateway, a local network gateway for site-to-site VPN, or an ExpressRoute circuit), establishing cross-premises or cross-network IPsec/ExpressRoute connectivity.

These connections bridge Azure VNets with on-premises or partner networks; compromise can expose the IPsec pre-shared key, intercept tunnel traffic, or sever connectivity for dependent workloads.

Microsoft.​Network/​connections/​startpacketcapture/​action

Starts a packet capture on the gateway connection, recording traffic traversing the tunnel and enabling collection and eventual exfiltration of potentially sensitive in-transit data.

Risks

1. Data exfiltration (CRITICAL)
2. Automated data collection (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links