services / Azure / Virtual network gateway

An Azure Virtual Network Gateway provides VPN (site-to-site / point-to-site) and ExpressRoute connectivity between an Azure VNet and on-premises or remote networks. It is the production network ingress/egress edge for hybrid connectivity.

A gateway is the trust boundary for a single VNet's hybrid/remote connectivity; control of it can expose or sever access to an entire private network and its hosted services.

Microsoft.​Network/​virtualNetworkGateways/​startpacketcapture/​action

Starts a packet capture on the gateway, enabling collection and subsequent exfiltration of in-transit network traffic that may contain sensitive data.

Risks

1. Data exfiltration (CRITICAL)
2. Automated data collection (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links