Azure RBAC Owner Assignment
Microsoft.Authorization/roleAssignments/write on a scope lets the principal grant itself Owner — across subscription / RG / resource.
§ Where this technique fits
C-AZ-RBAC-OWNER is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 3 approved dossiers in the registry, typically at step 4.7 on average.
§ Dossiers chaining this technique
- step 4 / 5
Compromised VM → Managed Identity → Subscription Owner
A VM with an over-privileged system-assigned managed identity is compromised; query IMDS for an Azure AD token, then assign yourself Owner on the subscription.
- step 5 / 7
Vish helpdesk → Okta MFA reset → admin → ransomware (MGM-class)
Identify an Okta admin via LinkedIn. Vish the helpdesk pretending to be that admin, get MFA reset. Sign in, plant attacker MFA factor, then push policy changes that disable MFA for chosen apps before mass-deploying ransomware.
- step 5 / 6
Entra app consent phishing → Global Admin equivalent
Phish a privileged user to consent to an OAuth app requesting Directory.ReadWrite.All + RoleManagement.ReadWrite.Directory — the app then grants itself Global Administrator.
§ What commonly comes next
- 01Azure VM RunCommandseen 1×C-AZ-RUNCOMMAND-VM · Lateral Movement
- 02Entra Application Persistenceseen 1×C-AZ-APP-PERSIST · Persistence
- 03Valid Accountsseen 1×T1078 · Initial Access