services / Azure / Virtual network subnet

A subnet is a segment of a virtual network's address space, used to isolate groups of resources and as the attachment point for NSGs, route tables, service endpoints, and delegated services.

Subnets are the unit of network segmentation within a VNet; control-plane privileges on it — altering address ranges, NSG/route-table associations, delegations, or attaching unauthorized resources into it — can enable significant privilege escalation via lateral network access (per the CRITICAL definition in services/README.md).

Microsoft.​Network/​virtualNetworks/​subnets/​delete

Deletes the subnet, disconnecting every resource attached to it and removing its NSG/route-table/service-endpoint configuration.

Risks

1. Denial-of-service (HIGH)
2. Network destruction (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links