DET-A7: Confidential VM disk exported or snapshotted¶
A disk export (beginGetAccess) or snapshot write took the confidential VM's OS disk out of the instance, lifting its state out of the VM's access controls.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Azure confidential VMs |
| Group | cloud |
| Log source | Azure Activity Log · Compute |
| Related | AZURE-DISK-01 |
Fires when¶
Disks/beginGetAccess OR Snapshots write AND disk == CVM OS disk
How it runs¶
untrust detect --platform azure-cvm reads the Activity Log and Key Vault AuditEvent entries, live (with azure-mgmt-monitor and azure-identity installed) or from an exported file passed with --azure-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.