Add Azure technique: Retrieve App Service Publishing Credentials

[arpitjain099]

What this does

Adds a new Azure attack technique, azure.credential-access.app-service-publishing-credentials, that retrieves the publishing profile of an Azure App Service (Web App). The publishing profile contains FTP and Web Deploy credentials in cleartext.

An attacker with read-or-higher access to an App Service can call the Microsoft.Web/sites/publishxml/action ARM operation to download these credentials, without needing access to any Key Vault or secret store. The returned XML contains userName and userPWD attributes that grant direct FTP and Web Deploy access to the application host, which can be used for lateral movement or to deploy malicious code to the running application.

Closes #871.

Behavior

• Warm-up: provisions an App Service plan and a Linux Web App (main.tf).
• Detonation: calls WebAppsClient.ListPublishingProfileXMLWithSecrets (the publishxml action) via the Azure SDK for Go, reads the returned publishing profile.
• Idempotent, no revert needed (read-only retrieval).

MITRE ATT&CK

• Credential Access (the technique maps to the Credential Access tactic, consistent with how other read-the-secret techniques are tagged).

References

• STORM-2949 incident, where the actor harvested App Service publishing credentials to move from a compromised identity into application hosts: https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/
• ARM API: POST /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Web/sites/{app}/publishxml

Implementation notes

• Modeled on the existing Azure techniques azure.exfiltration.disk-export (helper client constructor, providers.Azure() credential plumbing) and azure.execution.vm-run-command (SDK client construction and detonation shape).
• New dependency: github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/appservice/armappservice/v4 (added to v2/go.mod).
• Registered via the standard go:embed main.tf + init() RegisterAttackTechnique mechanism, and added to the imports in v2/internal/attacktechniques/main.go.
• Docs regenerated with make docs (new technique page, Azure index, list, coverage matrix, index.yaml).

Validation

Validated locally with go build ./..., go vet ./..., go test ./pkg/... (registry/loader), and make docs, all passing. This was not detonated against live Azure, since that requires a subscription; the API call shape follows the Azure SDK and the documented publishxml operation.