Skip to content

AZT301.3 - Virtual Machine Scripting: Desired State Configuration#

By utilizing the 'Desired State Configuration extension' extension on a Virtual Machine, an attacker can pass PowerShell commands to the VM as SYSTEM.

Resource

  • Virtual Machine
  • Virtual Machine Scale Sets

Actions

  • Microsoft.Compute/virtualMachines/extensions/*
  • Microsoft.Compute/virtualMachines/write

Detections

Logs#

Data Source Operation Name Action Log Location
Resource Create or Update Virtual Machine Extension Microsoft.Compute/virtualMachines/extensions/write Azure Activity Log
On-Resource File File Creation N/A C:\Packages\Plugins\Microsoft.Powershell.DSC\2.83.2.0\Status

Queries#

   |where OperationNameValue=="Microsoft.Compute/virtualMachines/extensions/write"