Unusual Azure VM Extension Detected

  1[metadata]
  2creation_date = "2026/06/15"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/06/15"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the first time a given VM extension name is created or updated on an Azure virtual machine or VM scale set within the
 11rule's lookback window. VM extensions run with high privilege on the guest (SYSTEM on Windows, root on Linux) and are a
 12common code-execution and persistence primitive. The extension instance name is attacker-controlled and the Azure
 13activity log records only that name, not the publisher or type, so the control plane cannot reliably identify the
 14extension family (for example CustomScript). This rule therefore takes a type-agnostic ES|QL new-terms approach: it
 15derives the host and the extension instance name from `azure.resource.name` and alerts the first time a given
 16(host, extension name) pair is observed in the window, surfacing novel extension deployments while suppressing names a
 17host routinely uses.
 18"""
 19false_positives = [
 20    """
 21    Legitimate provisioning, patching, and configuration-management automation may deploy an extension to a
 22    host for the first time. The first occurrence per host will alert. Baseline expected automation principals and hosts
 23    and exclude verified-benign ones.
 24    """,
 25]
 26from = "now-7d"
 27interval = "5m"
 28language = "esql"
 29license = "Elastic License v2"
 30name = "Unusual Azure VM Extension Detected"
 31note = """## Triage and analysis
 32
 33### Investigating Unusual Azure VM Extension Detected
 34
 35Identifies the first time a given VM extension name is created or updated on an Azure virtual machine or VM scale set within the
 36rule's lookback window. VM extensions run with high privilege on the guest (SYSTEM on Windows, root on Linux) and are a
 37common code-execution and persistence primitive. The extension instance name is attacker-controlled and the Azure
 38activity log records only that name, not the publisher or type, so the control plane cannot reliably identify the
 39extension family (for example CustomScript). This rule therefore takes a type-agnostic ES|QL new-terms approach: it
 40derives the host and the extension instance name from `azure.resource.name` and alerts the first time a given
 41(host, extension name) pair is observed in the window, surfacing novel extension deployments while suppressing names a
 42host routinely uses.
 43
 44### Possible investigation steps
 45
 46- Identify the host (`Esql.vm_name`) and the full extension resource (`azure.resource.name` / `azure.resource.id`).
 47- Identify the acting principal: `Esql.principal_id_values`, `Esql.principal_type_values` (User vs ServicePrincipal),
 48  `Esql.appid_values`. Service principal or managed identity deployment is more suspicious than a known admin user.
 49- Review the source: `Esql.source_ip_values`, `Esql.source_as_number_values`, `Esql.source_country_values`. Cloud
 50  hosting, VPS, or anonymizing networks are more suspicious than known corporate egress.
 51- Was this preceded by a Run Command invocation, role assignment, or other VM operations by the same principal?
 52- Correlate with endpoint telemetry on the host: process activity parented by the Azure guest agent
 53  (`WaAppAgent.exe` / `walinuxagent`) within ~120 seconds of the deployment.
 54- Review the principal's Entra ID sign-in logs and RBAC role assignments on the subscription, resource group, and VM.
 55- Retrieve the extension settings/protected settings from the VM (the activity log does not contain the script/settings
 56  body) to assess intent.
 57- Pivot on the VM for credential access, new local accounts, or outbound C2 connections following the deployment.
 58
 59### False positive analysis
 60
 61- This is a broad first-seen net: the first deployment of any extension name to a host alerts, so benign monitoring,
 62  antimalware (Defender/MDE), AKS, DSC, or configuration-management extensions deployed by routine automation will
 63  trigger. Baseline expected automation principals (`Esql.appid_values`) and extension names, and exclude verified ones.
 64- Automation that generates a unique extension instance name per deployment produces a new (host, name) pair every time
 65  and will recur; if benign, exclude by the deploying principal/appid or the known naming pattern rather than per host.
 66- Newly provisioned VMs receiving their initial extension set are expected. Corroborate the deploying principal and
 67  source before escalating, and treat deployments from known corporate egress by approved automation as lower confidence.
 68
 69### Response and remediation
 70
 71- If unauthorized, remove the extension, isolate the VM, rotate credentials reachable from it, and review RBAC on the affected scope.
 72- Collect endpoint and activity log artifacts per incident procedures.
 73"""
 74references = [
 75    "https://www.netspi.com/blog/technical-blog/adversary-simulation/7-ways-to-execute-command-on-azure-virtual-machine-virtual-machine-scale-sets/",
 76    "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows",
 77    "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/overview",
 78    "https://blog.pwnedlabs.io/diving-deep-into-azure-vm-attack-vectors",
 79    "https://www.sysdig.com/blog/the-expendable-extension-name-azure-vmaccess-naming-chaos-password-resets-and-a-detection-gap",
 80]
 81risk_score = 47
 82rule_id = "d29b0a67-178d-4381-92c5-02e9fd9a6ef6"
 83severity = "medium"
 84tags = [
 85    "Domain: Cloud",
 86    "Data Source: Azure",
 87    "Data Source: Azure Activity Logs",
 88    "Use Case: Threat Detection",
 89    "Tactic: Execution",
 90    "Tactic: Persistence",
 91    "Resources: Investigation Guide",
 92]
 93timestamp_override = "event.ingested"
 94type = "esql"
 95query = '''
 96FROM logs-azure.activitylogs-*
 97| WHERE event.dataset == "azure.activitylogs"
 98    AND event.action IN (
 99        "MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE",
100        "MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/EXTENSIONS/WRITE"
101    )
102    AND event.outcome IN ("success", "Success")
103// azure.resource.name is "<host>/EXTENSIONS/<instance-name>"; the instance name is attacker-controlled,
104// so key on the host (first path element) rather than the spoofable extension name
105| EVAL Esql.vm_name = MV_FIRST(SPLIT(azure.resource.name, "/"))
106| EVAL Esql.extension_name = MV_LAST(SPLIT(azure.resource.name, "/"))
107| STATS Esql.first_time_seen = MIN(@timestamp),
108        Esql.last_time_seen = MAX(@timestamp),
109        Esql.event_count = COUNT(*),
110        Esql.resource_name_values = VALUES(azure.resource.name),
111        Esql.resource_id_values = VALUES(azure.resource.id),
112        Esql.principal_id_values = VALUES(azure.activitylogs.identity.authorization.evidence.principal_id),
113        Esql.principal_type_values = VALUES(azure.activitylogs.identity.authorization.evidence.principal_type),
114        Esql.appid_values = VALUES(azure.activitylogs.identity.claims.appid),
115        Esql.source_ip_values = VALUES(source.ip),
116        Esql.source_as_number_values = VALUES(source.`as`.number),
117        Esql.source_country_values = VALUES(source.geo.country_name),
118        Esql.subscription_id_values = VALUES(azure.subscription_id)
119        BY Esql.vm_name, Esql.extension_name
120// new terms emulation: fire only when the (host, extension name) pair is the single occurrence in the
121// 7-day window (event_count == 1) and it is recent (within the schedule interval + ingest-lag buffer)
122| EVAL Esql.recent_minutes = DATE_DIFF("minute", Esql.first_time_seen, NOW())
123| WHERE Esql.recent_minutes <= 10 AND Esql.event_count == 1
124// surface real fields for the analyst and rule exceptions
125| EVAL azure.resource.name = MV_FIRST(Esql.resource_name_values),
126       azure.resource.id = MV_FIRST(Esql.resource_id_values),
127       source.ip = MV_FIRST(Esql.source_ip_values)
128| KEEP azure.resource.name, azure.resource.id, source.ip, Esql.*
129'''
130
131[rule.alert_suppression]
132group_by = ["azure.resource.name"]
133missing_fields_strategy = "suppress"
134
135[rule.alert_suppression.duration]
136unit = "m"
137value = 60
138
139[[rule.threat]]
140framework = "MITRE ATT&CK"
141
142[[rule.threat.technique]]
143id = "T1651"
144name = "Cloud Administration Command"
145reference = "https://attack.mitre.org/techniques/T1651/"
146
147[rule.threat.tactic]
148id = "TA0002"
149name = "Execution"
150reference = "https://attack.mitre.org/tactics/TA0002/"
151
152[[rule.threat]]
153framework = "MITRE ATT&CK"
154
155[[rule.threat.technique]]
156id = "T1037"
157name = "Boot or Logon Initialization Scripts"
158reference = "https://attack.mitre.org/techniques/T1037/"
159
160[rule.threat.tactic]
161id = "TA0003"
162name = "Persistence"
163reference = "https://attack.mitre.org/tactics/TA0003/"