Monitoring Azure Run Command for Unauthorized Execution

The Azure Virtual Machine Run Command feature enables administrators to execute scripts on virtual machine guests remotely, bypassing the need for interactive RDP or SSH sessions. While this is a legitimate management capability, it represents a significant risk if hijacked by threat actors who have compromised Azure RBAC permissions. On Windows guests, Run Command typically spawns PowerShell processes with specific command-line arguments like -ExecutionPolicy Unrestricted and a script?.ps1 file. On Linux, the Azure Linux Agent (waagent) invokes shell scripts stored in "/var/lib/waagent/run-command/download/". Because cloud activity logs confirm the administrative request but do not always detail the on-guest payload, defenders must rely on endpoint process lineage to gain visibility into the actual malicious behavior initiated by these commands.

Impact

Successful abuse of this feature allows attackers to achieve persistent remote code execution on guest virtual machines. This can lead to total system compromise, exfiltration of sensitive data residing on the VM, or lateral movement within the cloud environment. Given that these actions originate from the Azure control plane, they are often difficult to detect without integrated cloud and endpoint telemetry.

Recommendation

• Deploy process-creation detection rules targeting the Azure Run Command patterns identified in this brief to your EDR or SIEM platform.
• Correlate guest-level process start events with Azure Activity Logs (look for operation name MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION) to differentiate between legitimate administrative tasks and potential attacker activity.
• Audit and restrict Azure RBAC permissions for the VirtualMachineRunCommand role to ensure only necessary personnel and service principals have access.
• Baseline known-good automation scripts, deployment windows, and service account behaviors to reduce false positives in the provided detection logic.