services / Azure / Network Interface Tap Configuration

A Network Interface Tap Configuration attaches a Virtual Network TAP to a network interface, causing all of that NIC's traffic to be mirrored to a collector destination.

Traffic-mirroring configuration on a production NIC; when created it enables wholesale interception of in-transit data for that interface.

Microsoft.​Network/​networkInterfaces/​tapConfigurations/​write

Creating the tap configuration mirrors all of the NIC's traffic to an attacker-chosen collector, enabling continuous, automated interception and exfiltration of in-flight data.

Risks

1. Data exfiltration (CRITICAL)
2. Automated data collection (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links