Azure Vm Run Command Or Custom Script Execution Detected

AzureActivity | where CategoryValue == "Administrative" | where OperationNameValue =~ "Microsoft.Compute/virtualMachines/runCommand/action" | extend VMName = tostring(todynamic(Properties).resource) | summarize make_list(ActivityStatusValue), TimeGenerated = max(TimeGenerated) by CorrelationId, CallerIpAddress, Caller, ResourceGroup, VMName

Explanation

This query is used to detect when a user initiates an Azure VM Run Command or Custom Script execution. It looks for Azure activity events with the category "Administrative" and the operation name "Microsoft.Compute/virtualMachines/runCommand/action". It then summarizes the results by correlation ID, caller IP address, caller, resource group, and VM name. The query is scheduled to run every 30 minutes and has a query period of 35 minutes. The severity of the detection is medium. Incidents are created for each detection, and there is no incident grouping or suppression enabled. The query does not group events by any specific entities.

Details

Fabian Bader

Released: July 25, 2023

Tables

AzureActivity

Keywords

AzureActivityCategoryValueOperationNameValueMicrosoft.Compute/virtualMachines/runCommand/actionPropertiesresourceActivityStatusValueTimeGeneratedCorrelationIdCallerIpAddressCallerResourceGroupVMName

Operators

|===~extendsummarizewheretodynamicmaxbymake_list

Severity

Medium

Tactics

ExecutionLateralMovement

MITRE Techniques

T1059

Frequency: 30m

Period: 35m

KQL Search