services / Azure / Network Watcher packet captures

A Network Watcher packet capture is a network diagnostic resource that records live network traffic to and from a target VM/endpoint and writes the captured packets to a storage account or local file.

Captured traffic can contain sensitive in-transit data including credentials, tokens, and application payloads, making the create capability effectively a data-interception tool. Status/configuration reads expose only diagnostic metadata, not the captured payload.

Microsoft.​Network/​networkWatchers/​packetCaptures/​write

Creating a packet capture records live network traffic from a target resource into attacker-readable storage, enabling interception and automated collection of sensitive in-transit data (credentials, tokens, payloads) while incurring capture/storage cost.

Risks

1. Data exfiltration (CRITICAL)
2. Automated data collection (BOOST)
3. Spend (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links