services / Azure / Site Recovery replication recovery plan

A Site Recovery recovery plan orchestrates failover of a group of protected items in a defined sequence, including pre/post steps such as Azure Automation runbooks and manual actions.

Recovery plans define the org's coordinated failover orchestration and can invoke automation; manipulating one can sabotage recovery or inject attacker-controlled steps, and deleting one removes the ability to recover the grouped workloads in a coordinated way.

Microsoft.​RecoveryServices/​Vaults/​replicationRecoveryPlans/​write

Editing a recovery plan can reorder or break the failover sequence (defeating orderly recovery) and can add Azure Automation runbook steps that execute in the automation account's context, giving an attacker a code-execution foothold.

Risks

1. Data manipulation (HIGH)
2. Lateral movement (BOOST)
3. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links