KQL Search

Query Details

HomeAI ToolsDevice Query

Azure VM Run Commandor Custom Script Execution

Query

id: e26fd335-b592-451d-88ae-ba7d0d58e2f0
name: Azure VM Run Command or Custom Script execution
description: |
  'Identifies when Azure Run command is used to execute a powershell script on a VM.'
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActivity
    dataTypes:
      - AzureActivity
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
  - CredentialAccess
relevantTechniques:
  - T1570
query: |
  AzureActivity 
  | where CategoryValue == "Administrative"
  | where OperationNameValue =~ "Microsoft.Compute/virtualMachines/runCommand/action"
  | extend VMName = tostring(todynamic(Properties).resource)
  | summarize make_list(ActivityStatusValue), timestamp = max(TimeGenerated) by CorrelationId, IPCustomEntity=CallerIpAddress, AccountCustomEntity=Caller, ResourceGroup, HostCustomEntity=VMName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostCustomEntity
version: 1.0.0
kind: Scheduled

Explanation

This query is used to identify when the Azure Run command is used to execute a PowerShell script on a virtual machine (VM). It looks for Azure activity logs with the category "Administrative" and the operation name "Microsoft.Compute/virtualMachines/runCommand/action". It then extracts relevant information such as the activity status, timestamp, caller IP address, caller account, resource group, and VM name. The query is scheduled to run daily and has a medium severity level. It is relevant for techniques related to lateral movement and credential access.

Details

Fabian Bader profile picture

Fabian Bader

Released: March 25, 2022

Tables

AzureActivity

Keywords

AzureActivity,CategoryValue,OperationNameValue,Microsoft.Compute/virtualMachines/runCommand/action,Properties,resource,ActivityStatusValue,TimeGenerated,CorrelationId,CallerIpAddress,Caller,ResourceGroup,VMName,AccountCustomEntity,IPCustomEntity,HostCustomEntity,FullName,Address,HostName,Scheduled

Operators

|===~extendtostringsummarizemake_listmax

Actions