Azure Compute - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/azure-compute/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 24 Jan 2024 12:00:00 +0000Azure Compute VM Command Execution Detectedhttps://feed.craftedsignal.io/briefs/2024-01-24-azure-vm-command-execution/Wed, 24 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-24-azure-vm-command-execution/Successful execution of commands on Azure Virtual Machines, specifically the MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION operation, may indicate unauthorized activity or lateral movement attempts.This detection identifies command execution on Azure Virtual Machines (VMs) by monitoring Azure activity logs for the MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION operation. While roles like Virtual Machine Contributor allow managing VMs, they do not inherently grant access. However, adversaries can leverage PowerShell to remotely execute commands on a VM as the SYSTEM user. This rule is triggered upon successful command execution and could indicate malicious activity, particularly if initiated by unexpected users or systems. The rule aims to detect unauthorized command executions, potentially revealing lateral movement or unauthorized access attempts. Originally created in August 2020, this rule was last updated on April 10, 2026.

Attack Chain

  1. An attacker compromises an Azure account or service principal with Virtual Machine Contributor or similar permissions.
  2. The attacker authenticates to the Azure environment using the compromised credentials.
  3. The attacker identifies a target Azure Virtual Machine.
  4. The attacker utilizes the RunCommand feature of the Azure Compute service to execute commands on the target VM. This leverages the MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION operation.
  5. The command is executed on the VM with SYSTEM privileges.
  6. The attacker attempts to perform reconnaissance, such as listing directory contents, user accounts, or network configurations.
  7. The attacker may attempt to move laterally by installing malware, creating new accounts, or modifying system configurations.
  8. The attacker achieves their objective, such as data exfiltration or establishing persistence within the Azure environment.

Impact

Successful exploitation can lead to unauthorized access to sensitive data, installation of malware, lateral movement within the Azure environment, and potential compromise of other resources. While the specific number of victims and targeted sectors are not provided, the impact on affected organizations includes data breaches, system downtime, and reputational damage. The damage depends on the commands executed and the attacker's ultimate objectives.

Recommendation

  • Deploy the Sigma rule Azure Compute VM Command Executed to your SIEM to detect suspicious command executions (see below).
  • Review Azure activity logs for the MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION operation and investigate any unexpected command executions.
  • Implement least privilege access controls for Azure resources, limiting the ability to execute commands on VMs to only authorized users and service principals.
  • Monitor the roles and permissions of users and service principals with Virtual Machine Contributor roles, revoking unnecessary permissions.
  • Configure alerting on successful MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION events to enable rapid incident response.
  • Correlate command execution events with other security logs to identify potential lateral movement or other suspicious activities.
]]>mediumadvisoryazureexecutioncloudvmAzure Compute Restore Point Collection Deleted by Unusual Userhttps://feed.craftedsignal.io/briefs/2024-01-azure-restore-point-deletion/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-azure-restore-point-deletion/The deletion of Azure Restore Point Collections, which contain recovery points for virtual machines, by a user who has not previously performed this activity, indicates a potential attempt to prevent recovery during ransomware attacks or cover tracks during malicious operations.This detection identifies the deletion of Azure Restore Point Collections by a user who has not previously performed this activity. Restore Point Collections contain recovery points for virtual machines, enabling point-in-time recovery capabilities, and their deletion can severely impact an organization's ability to recover from incidents, making them attractive targets for adversaries. This rule leverages Azure Activity Logs to detect unusual deletion activity, specifically focusing on the "MICROSOFT.COMPUTE/RESTOREPOINTCOLLECTIONS/DELETE" event. The goal is to identify potentially malicious activity, such as ransomware attacks or attempts to cover tracks during malicious operations, targeting Azure environments. The activity logs are analyzed to create a baseline of users deleting Azure restore point collections, and deviations from this baseline are considered anomalous.

Attack Chain

  1. Initial Access: The attacker gains unauthorized access to an Azure account, potentially through compromised credentials or exploiting a vulnerability.
  2. Privilege Escalation: The attacker escalates privileges within the Azure environment to gain the necessary permissions to manage and delete Restore Point Collections.
  3. Discovery: The attacker identifies Restore Point Collections associated with critical virtual machines within the Azure environment.
  4. Credential Access: The attacker attempts to gain access to additional accounts or credentials stored within the compromised system.
  5. Impair Defenses: The attacker deletes the Restore Point Collections to inhibit system recovery and prevent restoration of virtual machines to a previous state. The event is logged as "MICROSOFT.COMPUTE/RESTOREPOINTCOLLECTIONS/DELETE" in Azure Activity Logs.
  6. Impact: The attacker encrypts virtual machines with ransomware, knowing that recovery from backups is hindered due to the deleted Restore Point Collections.
  7. Cover Tracks: The attacker attempts to delete logs and other evidence of their activity to prevent detection and investigation.

Impact

Successful deletion of Azure Restore Point Collections can severely impact an organization's ability to recover from ransomware attacks or other malicious activities. The loss of these recovery points can lead to extended downtime, data loss, and financial repercussions. The blog post referenced describes STORM-0501 using similar techniques in hybrid cloud environments. The impact may extend across cloud and on-premise systems. The number of affected virtual machines and the criticality of the impacted systems will determine the overall impact.

Recommendation

  • Deploy the following Sigma rule to detect unusual deletions of Azure Restore Point Collections and tune it to your environment.
  • Review Azure Activity Logs for the event "MICROSOFT.COMPUTE/RESTOREPOINTCOLLECTIONS/DELETE" to investigate potentially malicious deletions.
  • Implement the principle of least privilege for Azure account permissions to limit the potential impact of compromised accounts.
  • Monitor the azure.activitylogs.identity.claims_initiated_by_user.name and azure.resource.group fields to identify the specific user and resource groups involved in deletion activities.
  • Investigate any alerts generated by the Sigma rules, following the triage and analysis steps outlined in the rule's note field.
]]>mediumadvisorycloudazureimpact