infrastructure-as-code, configuration management, and patching automation may create or update managed run commands. the first occurrence per principal will alert; baseline expected service principals, managed identities, and admin users and exclude them if the activity is verified as authorized.

Techniques

T1651

Sample rules

Azure VM Managed Run Command Created or Updated with Unusual Principal

source: elastic
technicques:
- T1651

Description

Identifies the creation or update of a managed Azure Run Command resource (“MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMANDS/WRITE” or the virtual machine scale set equivalent) by an identity that has not performed this operation recently. Unlike the action-based Run Command (“runCommand/action”), the managed Run Command is a persistent resource on the VM whose creation or update executes the supplied script as System (Windows) or root (Linux). Because creating a managed run command both executes code and leaves a durable object, adversaries can use it as an alternative to the action invocation to evade detections that only watch “runCommand/action”. Alerting on the first time a given principal performs this operation surfaces unusual or unauthorized use while suppressing routine automation that repeatedly manages the same run commands.

Detection logic

data_stream.dataset:azure.activitylogs and
    event.action:(
        "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMANDS/WRITE" or
        "MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/VIRTUALMACHINES/RUNCOMMANDS/WRITE"
    ) and event.outcome:(success or Success) and
    azure.activitylogs.identity.authorization.evidence.principal_id: *