services / Azure / Log Analytics data export

A data export rule that continuously ships ingested log data from selected tables to a destination such as a storage account or Event Hub.

An export rule streams a live copy of ingested logs to an external destination; it can be abused to exfiltrate all telemetry or, when removed, to cut a downstream SIEM feed; HIGH.

Microsoft.​OperationalInsights/​workspaces/​dataexports/​write

Creating an export rule can continuously copy all ingested logs to attacker-controlled storage or an Event Hub, exfiltrating telemetry that may contain sensitive organizational data.

Risks

1. Data exfiltration (CRITICAL)
2. Logs exfiltration (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links