Azure VM Extension Deployment by User

  1[metadata]
  2creation_date = "2026/05/20"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the successful deployment of a high-risk Azure Virtual Machine extension by an interactive user principal.
 11Attackers with privileged Azure RBAC roles can abuse VM extensions such as VMAccess, CustomScriptExtension, and
 12RunCommand to execute arbitrary code, create backdoor accounts, harvest credentials, and establish persistence on
 13Azure-hosted virtual machines without requiring direct network access to the VM.
 14"""
 15false_positives = [
 16    """
 17    Legitimate administrators and automation may deploy Custom Script, Run Command, DSC, or monitoring extensions during
 18    provisioning, patching, or guest configuration. Baseline expected principals, VMs, and extension types before
 19    tuning exclusions.
 20    """,
 21]
 22from = "now-9m"
 23index = ["logs-azure.activitylogs-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "Azure VM Extension Deployment by User"
 27note = """## Triage and analysis
 28
 29### Investigating Azure VM Extension Deployment by User
 30
 31This rule flags successful `MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE` operations performed by a user principal
 32where the extension resource ID matches high-risk extension families (VMAccess, Custom Script, Run Command, DSC,
 33Microsoft Monitoring Agent).
 34
 35### Triage checklist
 36
 37- Is the caller UPN a known admin or automation account?
 38- Is the source IP or ASN consistent with corporate infrastructure or a known VPN?
 39- Was this extension deployment preceded by a Run Command invocation on the same VM?
 40- Did the extension deployment coincide with new local account creation on the endpoint?
 41- Check `azure.activitylogs.identity.claims.authnmethodsreferences` — was MFA present?
 42- Correlate with endpoint telemetry: process events parented by `WaAppAgent.exe` or `walinuxagent` within 120 seconds of
 43  the extension write timestamp on the same host.
 44
 45### Possible investigation steps
 46
 47- Review `azure.activitylogs.identity.authorization.evidence.principal_id` and Entra sign-in logs for the caller.
 48- Examine `azure.resource.id` and `azure.resource.name` to identify the VM and extension type deployed.
 49- Pivot on the VM for `MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION` and endpoint Run Command or `waagent` activity.
 50- Review role assignments for the principal on the subscription or resource group.
 51
 52### Response and remediation
 53
 54- If unauthorized, remove the extension, rotate credentials, and review RBAC on the affected VM and scope.
 55- Isolate the VM and collect endpoint and activity log artifacts per incident procedures.
 56"""
 57references = ["https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/overview"]
 58risk_score = 47
 59rule_id = "e842d39d-ead1-48c6-97f1-6b055476c2f3"
 60severity = "medium"
 61tags = [
 62    "Domain: Cloud",
 63    "Domain: Endpoint",
 64    "Data Source: Azure",
 65    "Data Source: Azure Activity Logs",
 66    "Use Case: Threat Detection",
 67    "Tactic: Persistence",
 68    "Tactic: Defense Evasion",
 69    "Tactic: Execution",
 70    "Resources: Investigation Guide",
 71    "Noise: Unknown",
 72    "Performance: Fast",
 73    "Profile: Recommended",
 74    "Threat: Cloud VM Execution",
 75    "Rule Type: Custom Query (KQL)",
 76    "Platform: Azure",
 77]
 78timestamp_override = "event.ingested"
 79type = "query"
 80query = '''
 81data_stream.dataset:azure.activitylogs and
 82azure.activitylogs.operation_name:"MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE" and
 83azure.activitylogs.identity.authorization.evidence.principal_type:User and
 84event.outcome:(success or Success) and
 85azure.resource.id:(
 86    *VMACCESSAGENT* or
 87    *CUSTOMSCRIPTEXTENSION* or
 88    *RUNCOMMANDWINDOWS* or
 89    *RUNCOMMANDLINUX* or
 90    */DSC/* or
 91    *MICROSOFTMONITORINGAGENT*
 92)
 93'''
 94
 95[rule.investigation_fields]
 96field_names = [
 97    "@timestamp",
 98    "event.outcome",
 99    "azure.activitylogs.operation_name",
100    "azure.activitylogs.identity.authorization.evidence.principal_id",
101    "azure.activitylogs.identity.authorization.evidence.principal_type",
102    "azure.activitylogs.identity.claims_initiated_by_user.name",
103    "azure.resource.id",
104    "azure.resource.name",
105    "source.ip",
106    "source.geo.country_name",
107    "source.as.organization.name",
108    "azure.subscription_id",
109    "azure.activitylogs.tenant_id",
110]
111
112[[rule.threat]]
113framework = "MITRE ATT&CK"
114
115[[rule.threat.technique]]
116id = "T1098"
117name = "Account Manipulation"
118reference = "https://attack.mitre.org/techniques/T1098/"
119
120[rule.threat.tactic]
121id = "TA0003"
122name = "Persistence"
123reference = "https://attack.mitre.org/tactics/TA0003/"
124
125[[rule.threat]]
126framework = "MITRE ATT&CK"
127
128[[rule.threat.technique]]
129id = "T1651"
130name = "Cloud Administration Command"
131reference = "https://attack.mitre.org/techniques/T1651/"
132
133[rule.threat.tactic]
134id = "TA0002"
135name = "Execution"
136reference = "https://attack.mitre.org/tactics/TA0002/"
137
138[[rule.threat]]
139framework = "MITRE ATT&CK"
140
141[[rule.threat.technique]]
142id = "T1578"
143name = "Modify Cloud Compute Infrastructure"
144reference = "https://attack.mitre.org/techniques/T1578/"
145
146[[rule.threat.technique.subtechnique]]
147id = "T1578.002"
148name = "Create Cloud Instance"
149reference = "https://attack.mitre.org/techniques/T1578/002/"
150
151[rule.threat.tactic]
152id = "TA0005"
153name = "Defense Evasion"
154reference = "https://attack.mitre.org/tactics/TA0005/"