Suspicious Child Process via Azure VM CustomScript Extension

  1[metadata]
  2creation_date = "2026/06/17"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/06/17"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a suspicious process executing as a descendant of the Azure VM CustomScript extension handler
 11(CustomScriptHandler.exe) on a Windows host. The Azure CustomScript extension runs an attacker-supplied script with high
 12privilege (SYSTEM) via the guest agent, and is a common cloud-to-host code-execution and persistence primitive. Because
 13the extension's resource name is attacker-controlled and absent from on-host telemetry, this rule anchors on the
 14type-bearing handler binary ('Microsoft.Compute.CustomScriptExtension\\...\\CustomScriptHandler.exe') rather than the
 15spoofable extension name, making it resistant to renaming. CustomScript legitimately launches PowerShell and cmd, so the
 16rule fires only when the descendant is an execution-proxy, download, or discovery LOLBin, or PowerShell exhibiting
 17suspicious tradecraft.
 18"""
 19from = "now-9m"
 20index = ["logs-endpoint.events.process-*"]
 21language = "eql"
 22license = "Elastic License v2"
 23name = "Suspicious Child Process via Azure VM CustomScript Extension"
 24note = """## Triage and analysis
 25
 26### Investigating Suspicious Child Process via Azure VM CustomScript Extension
 27
 28The Azure CustomScript extension executes a script as SYSTEM via the guest agent. The extension's resource name is
 29attacker-controlled and not present on the host, so this rule anchors on the handler binary path
 30(`Microsoft.Compute.CustomScriptExtension\\...\\CustomScriptHandler.exe`), which is rename-proof, and alerts when a
 31LOLBin or suspicious PowerShell runs anywhere in its process tree.
 32
 33### Possible investigation steps
 34
 35- Review the full process tree from `CustomScriptHandler.exe` to the alerting process, including `process.command_line`
 36  and `process.args`.
 37- Identify the descendant: execution proxies (`mshta`, `regsvr32`, `rundll32`, `installutil`, `msbuild`), download tools
 38  (`certutil`, `bitsadmin`), script hosts (`wscript`, `cscript`), or discovery utilities (`whoami`, `net`, `nltest`,
 39  `wmic`) are not expected children of a benign CustomScript payload.
 40- Correlate with the control-plane event: a `MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE` in
 41  `logs-azure.activitylogs-*` for this host around the same time, and the acting principal/source behind it.
 42- Retrieve the extension's settings/protectedSettings from the VM (the activity log does not contain the script body) to
 43  assess intent.
 44- Pivot on the host for credential access, new local accounts, persistence, or outbound C2 following the execution.
 45- Review who deployed the extension (Entra sign-in logs and RBAC for the principal in the correlated activity log event).
 46
 47### False positive analysis
 48
 49- Infrastructure-as-code and configuration-management scripts deployed via CustomScript may legitimately run discovery
 50  utilities (`whoami`, `net`, `nltest`, `systeminfo`, `wmic`, `tasklist`, `arp`) for bootstrap or inventory. If the
 51  activity recurs from known automation, baseline it and exclude by `process.command_line`/`process.args`.
 52- Software installation and bootstrapping via CustomScript can invoke `msbuild`, `installutil`, `regsvr32`, `regasm`,
 53  `regsvcs`, `certutil`, or `bitsadmin` to build, register, or download legitimate components. Verify the target
 54  file/URL and, if benign, scope the exclusion to the specific command or signed binary rather than the whole LOLBin.
 55- Legitimate setup scripts (DSC bootstrap, agent installers) may use PowerShell download cradles
 56  (`Invoke-WebRequest`, `DownloadString`, `-EncodedCommand`) against trusted internal or Microsoft endpoints. Confirm
 57  the destination host and content before excluding, and exclude by the specific command line, not by host.
 58- A known automation principal deploying the extension from expected corporate egress (corroborated by the correlated
 59  `MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE` and an approved change) lowers confidence, but still review the
 60  executed content. Prefer narrow, command- or argument-scoped exclusions over broad host or LOLBin exclusions, since
 61  the same execution chain is exactly what an attacker abuses.
 62
 63### Response and remediation
 64
 65- If unauthorized, remove the extension, isolate the host, rotate credentials reachable from it, and review RBAC on the affected subscription/resource group.
 66"""
 67references = [
 68    "https://blog.pwnedlabs.io/diving-deep-into-azure-vm-attack-vectors",
 69    "https://www.sysdig.com/blog/the-expendable-extension-name-azure-vmaccess-naming-chaos-password-resets-and-a-detection-gap",
 70    "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows",
 71]
 72risk_score = 47
 73rule_id = "b4d4f0fb-908e-4cd1-ac8f-795c0433db0a"
 74severity = "medium"
 75tags = [
 76    "Domain: Endpoint",
 77    "OS: Windows",
 78    "Use Case: Threat Detection",
 79    "Tactic: Execution",
 80    "Tactic: Defense Evasion",
 81    "Data Source: Elastic Defend",
 82    "Resources: Investigation Guide",
 83]
 84timestamp_override = "event.ingested"
 85type = "eql"
 86query = '''
 87sequence by host.id with maxspan=1m
 88  /* Azure CustomScript extension handler */
 89  [process where host.os.type == "windows" and event.type == "start" and
 90     (process.name : "CustomScriptHandler.exe" or
 91      process.executable : "?:\\Packages\\Plugins\\*CustomScript*\\*\\CustomScriptHandler.exe")] by process.entity_id
 92  /* Abused LOLBin / suspicious PowerShell anywhere in its tree */
 93  [process where host.os.type == "windows" and event.type == "start" and
 94   (
 95     process.name : ("mshta.exe", "regsvr32.exe", "rundll32.exe", "installutil.exe", "msbuild.exe", "regasm.exe",
 96                     "regsvcs.exe", "wscript.exe", "cscript.exe", "bitsadmin.exe", "nltest.exe", "whoami.exe",
 97                     "net.exe", "net1.exe", "wmic.exe", "systeminfo.exe", "quser.exe", "arp.exe", "tasklist.exe") or
 98     (process.name : "certutil.exe" and process.args : ("*urlcache*", "*-decode*", "*-encode*")) or
 99     (process.name : ("powershell.exe", "pwsh.exe") and
100      process.command_line : ("*-enc*", "*EncodedCommand*", "*FromBase64String*", "*DownloadString*", "*DownloadFile*",
101                              "*Invoke-Expression*", "*IEX *", "*IEX(*", "*|IEX*", "*-w hidden*", "*WindowStyle Hidden*",
102                              "*Net.WebClient*", "*Invoke-WebRequest*", "*Start-BitsTransfer*"))
103   )] by process.Ext.ancestry
104'''
105
106[[rule.threat]]
107framework = "MITRE ATT&CK"
108
109[[rule.threat.technique]]
110id = "T1651"
111name = "Cloud Administration Command"
112reference = "https://attack.mitre.org/techniques/T1651/"
113
114[[rule.threat.technique]]
115id = "T1059"
116name = "Command and Scripting Interpreter"
117reference = "https://attack.mitre.org/techniques/T1059/"
118
119[[rule.threat.technique.subtechnique]]
120id = "T1059.001"
121name = "PowerShell"
122reference = "https://attack.mitre.org/techniques/T1059/001/"
123
124[[rule.threat.technique.subtechnique]]
125id = "T1059.003"
126name = "Windows Command Shell"
127reference = "https://attack.mitre.org/techniques/T1059/003/"
128
129[rule.threat.tactic]
130id = "TA0002"
131name = "Execution"
132reference = "https://attack.mitre.org/tactics/TA0002/"
133
134[[rule.threat]]
135framework = "MITRE ATT&CK"
136
137[[rule.threat.technique]]
138id = "T1218"
139name = "System Binary Proxy Execution"
140reference = "https://attack.mitre.org/techniques/T1218/"
141
142[rule.threat.tactic]
143id = "TA0005"
144name = "Defense Evasion"
145reference = "https://attack.mitre.org/tactics/TA0005/"