Description

Identifies Azure Batch pools where start tasks are configured to run with administrative (elevated) privileges. Running batch jobs with admin privileges poses a security risk as compromised jobs could gain unrestricted access to the system, violating the principle of least privilege.

Detection Strategy

• Examines each Azure Batch pool's start task configuration

• Checks if the start task's user_identity.auto_user.elevation_level is set to 'admin'

• Reports a vulnerability when batch jobs are configured to run with administrative privileges