Data Source: Microsoft Azure | Detection.FYI

Azure Run Command Correlated with Process Execution

Sep 19, 2026 · Domain: Cloud Domain: Endpoint OS: Windows OS: Linux Use Case: Threat Detection Tactic: Execution Data Source: Azure Data Source: Microsoft Azure Data Source: Azure Activity Logs Data Source: Elastic Defend Resources: Investigation Guide Noise: Unknown Performance: Normal Threat: Cloud VM Execution Rule Type: ES|QL Platform: Windows Platform: Linux Platform: Azure ·
Share on:

Correlates successful Azure Virtual Machine Run Command operations with endpoint process execution on the same host within minutes. Adversaries abuse Run Command to run scripts remotely as SYSTEM or root while activity logs only record the control-plane action; Elastic Defend process telemetry reveals the on-guest payload.

Read More