Data Source: Microsoft Azure | Detection.FYI

Azure Run Command Correlated with Process Execution

Jun 1, 2026 · Domain: Cloud Domain: Endpoint OS: Windows OS: Linux Use Case: Threat Detection Tactic: Execution Data Source: Azure Data Source: Microsoft Azure Data Source: Azure Activity Logs Data Source: Elastic Defend Resources: Investigation Guide ·
Share on:

Correlates successful Azure Virtual Machine Run Command operations with endpoint process execution on the same host within minutes. Adversaries abuse Run Command to run scripts remotely as SYSTEM or root while activity logs only record the control-plane action; Elastic Defend process telemetry reveals the on-guest payload.

Read More