services / Azure / Virtual network

An Azure virtual network (VNet) is the fundamental L3 network-isolation boundary in Azure, defining the address space, subnets, peerings, and security policy scope for all resources deployed into it.

The VNet is the primary network-segmentation boundary in Azure; control-plane privileges on it — altering peerings, address space, or security-group associations, or attaching unauthorized resources into it — can enable significant privilege escalation via lateral network access (per the CRITICAL definition in services/README.md).

Microsoft.​Network/​virtualNetworks/​ddosProtectionStatus/​action

Read-only reconnaissance that reveals whether DDoS protection is enabled for the VNet, letting an attacker identify under-protected targets before launching a volumetric attack.

Risks

1. Network discovery (LOW)

Scope: LOW

This privilege allows access to data that are not meant to be public, but are otherwise not sensitive.

Links