Skip to content
Threat Feed
Subscribe

Product

DSC

1 brief RSS
high advisory

Azure VM Extension CRUD from Unusual Source ASN

Threat actors are performing create, read, update, or delete (CRUD) operations against Azure VM or VM Scale Set extensions (e.g., CustomScript, DSC) from an anomalous source Autonomous System (AS) number, enabling high-privilege code execution and persistence on guest operating systems (SYSTEM on Windows, root on Linux) by abusing compromised Azure identities.

Azure VM +4 cloud endpoint azure azure-activity-logs threat-detection execution persistence
2r 2t