services / Azure / Network Watcher

Azure Network Watcher is a regional network diagnostics and monitoring service that provides flow logging, topology, and connectivity/troubleshooting tools for resources in a virtual network.

Network Watcher is a monitoring/diagnostics control-plane resource, not a data store; its main risk is as an evasion vector (disabling flow logging, removing the resource) and as a built-in network reconnaissance toolkit exposed via its action sub-resources.

Microsoft.​Network/​networkWatchers/​write

Creating/updating a Network Watcher can be used to reconfigure or replace the region's network diagnostics resource, similar in effect to deletion if used to disrupt existing monitoring configuration.

Risks

1. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links