Skip to content
Threat Feed
Subscribe

Tag

Cloud-to-Host

1 brief RSS
medium advisory

Suspicious Child Process Execution via Azure VM CustomScript Extension

Attackers with access to an Azure subscription or VM management plane can leverage the Azure VM CustomScript extension to execute arbitrary code with SYSTEM privileges on Windows virtual machines, leading to various malicious activities such as reconnaissance, malware deployment, and persistence.

Azure Virtual Machines CustomScript Extension windows execution cloud-to-host azure lolbin
1r 4t