Abuse of Azure WireServer for Credential Access and Discovery

Adversaries with established code execution on Azure Virtual Machines are targeting the Azure internal WireServer and HostGAPlugin service, located at the non-routable IP 168.63.129.16, to conduct discovery and credential theft. This internal fabric endpoint is utilized by the Azure Guest Agent to manage GoalState, transport certificates, and VM settings.

By executing unauthorized commands against TCP ports 80 or 32526 on this endpoint, attackers can extract metadata and decrypt extension settings, facilitating further lateral movement or privilege escalation within the cloud environment. Attackers typically employ common system utilities such as curl, PowerShell, openssl, or scripting runtimes to interact with this service. This activity bypasses the intended agent-based communication flow. Defenders must distinguish legitimate Guest Agent traffic from unauthorized process execution, which often manifests as descendants of the Azure Guest Agent when utilizing features like Run Command or Custom Script Extensions.

Attack Chain

1. Attacker gains initial code execution on an Azure VM via techniques like command injection or compromised credentials.
2. Attacker enumerates available services and identifies the local Azure fabric endpoint at 168.63.129.16.
3. Attacker executes unauthorized commands using system tools (curl, PowerShell, openssl) to reach WireServer ports 80 or 32526.
4. Attacker performs discovery by pulling version information and VM configuration state from the endpoint.
5. Attacker requests transport certificates or specific URI paths like /vmSettings from the HostGAPlugin.
6. Attacker uses openssl or other utilities to decrypt the retrieved sensitive blobs.
7. Attacker utilizes exfiltrated secrets or identity tokens to escalate privileges or pivot within the Azure environment.

Impact

Successful exploitation allows attackers to gain unauthorized access to transport certificates, managed identity tokens, and sensitive VM configuration data. This compromise can lead to full VM control, lateral movement to other cloud services, and persistent access within the target's Azure tenant.

Recommendation

Prioritize the implementation of process-to-network monitoring focusing on the WireServer IP 168.63.129.16.

• Deploy the provided Sigma rule to alert on unauthorized binaries connecting to the specified WireServer ports.
• Audit Azure Activity Logs for frequent runCommand or CustomScriptExtension actions that may indicate automation of this credential access technique.
• Implement Azure Metadata Security Protocol (audit or enforce mode) to restrict which processes are permitted to communicate with the WireServer fabric.
• Rotate managed identities and Service Access Signatures (SAS) immediately if unauthorized access to vmSettings or certificate blobs is detected.