Azure VM Run Commandor Custom Script Execution

AzureActivity | where CategoryValue == "Administrative" | where OperationNameValue =~ "Microsoft.Compute/virtualMachines/runCommand/action" | extend VMName = tostring(todynamic(Properties).resource) | summarize make_list(ActivityStatusValue), timestamp = max(TimeGenerated) by CorrelationId, IPCustomEntity=CallerIpAddress, AccountCustomEntity=Caller, ResourceGroup, HostCustomEntity=VMName

Explanation

This query is used to identify when the Azure Run command is used to execute a PowerShell script on a virtual machine (VM). It looks for Azure activity logs with the category "Administrative" and the operation name "Microsoft.Compute/virtualMachines/runCommand/action". It then extracts relevant information such as the activity status, timestamp, caller IP address, caller account, resource group, and VM name. The query is scheduled to run daily and has a medium severity level. It is relevant for techniques related to lateral movement and credential access.

Details

Fabian Bader

Released: March 25, 2022

Tables

AzureActivity

Keywords

AzureActivityCategoryValueOperationNameValueMicrosoft.Compute/virtualMachines/runCommand/actionPropertiesresourceActivityStatusValueTimeGeneratedCorrelationIdCallerIpAddressCallerResourceGroupVMNameAccountCustomEntityIPCustomEntityHostCustomEntityFullNameAddressHostNameScheduled

Operators

|===~extendtostringsummarizemake_listmax

Severity

Medium

Tactics

LateralMovementCredentialAccess

MITRE Techniques

T1570

Frequency: 1d

Period: 1d

KQL Search