> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_avere_contributor.md).

# AZ\_AVERE\_CONTRIBUTOR

## Summary

|                            |                                                            |
| -------------------------- | ---------------------------------------------------------- |
| **Forestall ACL Alias**    | AZ\_AVERE\_CONTRIBUTOR                                     |
| **Azure Alias**            | Avere Contributor (Azure RBAC)                             |
| **Affected Object Types**  | Virtual Machines                                           |
| **Exploitation Certainty** | Certain                                                    |
| **Azure RBAC Role**        | Avere Contributor (`4f8fab4f-1852-4a58-a46a-8eaf358af14a`) |

## Description

`AZ_AVERE_CONTRIBUTOR` represents the Azure RBAC **Avere Contributor** role assignment. This role was designed for managing Avere vFXT clusters but includes dangerous permissions that can be abused against standard Azure VMs.

The critical abuse vector is that this role includes:

* **Execute Run Commands** on VMs.
* **Manage VM extensions** which can be used for code execution.

## Identification

### PowerShell (Az Module)

```powershell
Connect-AzAccount

# List all Avere Contributor assignments
Get-AzRoleAssignment -RoleDefinitionName "Avere Contributor" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

```

### Azure CLI

```bash
# List Avere Contributor assignments
az role assignment list --role "Avere Contributor" -o table
```

### Azure Portal

1. Open **Azure Portal** -> **Subscriptions** (or target scope).
2. Go to **Access control (IAM)** -> **Role assignments**.
3. Filter by **Role = Avere Contributor**.
4. Review assignments - note that this role may be assigned for Avere clusters but affects all VMs.

## Exploitation

### Execute Run Command / Deploy Extension

Avere Contributor includes permissions for VM Run Command and extension deployment. For detailed exploitation techniques, see [**AZ\_EXECUTE\_COMMAND**](https://docs.forestall.io/fsprotect/edges/azure/az_execute_command).

## Mitigation

1. **Review and minimize Avere Contributor assignments**
   * This role should only be assigned to identities managing Avere vFXT clusters.
   * Scope assignments to specific Avere resources, not subscriptions or resource groups.
2. **Enable endpoint protection**
   * Deploy EDR solutions to detect post-exploitation activity.

## Detection

Use the Azure Portal:

1. Open **Azure Portal** -> **Monitor** -> **Activity log**.
2. Filter by **Operation name** containing:
   * `extensions/write`
   * `runCommand`
3. Review the **Initiated by** column for unexpected principals with Avere Contributor role.
4. Check the **Resource** column to identify affected VMs.
5. Open the affected VM and review **Extensions + applications**, **Run command**, and **Access control (IAM)**.

## References

* <https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#avere-contributor>
* <https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/vmaccess>