Azure Fabric Backdoor With A Twist

Azure Fabric PoC describes how an attacker can abuse Fabric notebooks and the Activator event engine to delay and trigger execution of Python code that uses the Azure Python SDK to create service principals, a user-assigned managed identity, a virtual machine with a public IP and an NSG allowing SSH from the Internet. The report includes full proof-of-concept code, notes on traces left (notebook run history, package uploads, Entra ID logs), prerequisites (Contributor/Owner permissions or a service principal), and recommended hardening (blocking internet access, private links, workspace outbound access protection).