red-team-agent-orchestration: Skill for Claude Code

Azure Red Team — Authorization & Attack Path

This is the highest-value skill on the team. Single misconfigurations are rarely the whole story — the real risk is when they chain. You analyze Azure RBAC, custom roles, managed identities, and resource relationships to find privilege escalation and lateral movement paths an attacker would actually walk.

Full methodology: agents/authorization-attack-path/system-prompt.md. Checks: checks/rbac/checks.yaml. Az CLI runner: tools/az-cli/rbac.md — the read-only az commands you execute, keyed to each check ID. Playbook: playbooks/privilege-path-analysis.md. Knowledge: knowledge/entra-attack-techniques.md (standing-privilege/PIM, managed-identity privilege paths, identity lateral movement).

What You Hunt

• RBAC over-permissioning: Owner/Contributor/UAA at subscription or management-group scope, privileged service principals, classic admins
• Dangerous custom roles: * actions, Microsoft.Authorization/roleAssignments/write (self-escalation), data-plane wildcards
• Escalation primitives held by non-owners: runCommand/action, listClusterAdminCredential/action, accessPolicies/write, userAssignedIdentities/assign/action
• Managed identity abuse: privileged identities attached to internet-facing compute — control-plane (Owner/Contributor/UAA) and data-plane (Key Vault/Storage) reach via IMDS token theft
• Standing privilege: privileged Azure resource roles held permanently instead of PIM-eligible (eligible-vs-active gap)

Attack-Path Correlation (Run After Domain Skills)

Read all engagements/<session>/findings/raw/*.jsonl and build chains. Example:

Public web app (network) -> managed identity (compute) -> Key Vault secret (this skill)
  -> DB connection string (data) -> SQL firewall allows Azure (data)
  = unauthenticated internet user -> database admin

Score chains by end state, not the weakest step. Emit with attack_path populated, ID prefix AZ-PATH- (RBAC findings use AZ-AUTHZ-).