Skip to content
TheCloud.Events

Microsoft.Compute/virtualMachines/write

Azure

Microsoft.Compute/virtualMachines/write

service: Azure - Compute
tactics:
techniques:
tags:
Azure Compute

Event

This is the generic VM create/update operation. VM extensions are separate child resources, even when an ARM deployment provisions them alongside a VM. A virtualMachines/write event does not demonstrate a Custom Script Extension or script execution.

Security Context

Unexpected VM changes warrant investigation, but the operation alone does not establish execution or persistence. No ATT&CK technique is assigned without more specific configuration and outcome evidence.

Log Source

Azure Activity Log, Administrative category, with operationName.value: Microsoft.Compute/virtualMachines/write. Inspect status/subStatus and related records; asynchronous acceptance is not final resource-state evidence. Request bodies are optional and export-dependent.

Key Fields

FieldInvestigation value
caller, claims, authorizationInitiating identity and recorded authorization context; corroborate effective permissions.
resourceId, correlationIdTarget and related operation records.
status, subStatusOutcome and asynchronous acceptance versus completion.
properties.requestbody, httpRequestConfiguration or command and endpoint when present; these fields are not guaranteed.

What to Investigate

  1. Confirm the recorded outcome and compare actor, target, and timing with the approved workflow.
  2. Recover the actual deployment and previous/new VM configuration to distinguish creation from an update.
  3. Correlate separate extension writes or Run Command records.
  4. Check provisioning outcome and guest evidence before attributing script execution or persistent access.

Sample Event

Synthetic scenario. The sample records a VM write without a request body. The previous invalid embedded extension payload was removed; neither extension installation nor guest execution is illustrated.

Exact field presence, modified-property names, payload nesting, and timestamp formatting remain unverified against captured logs. Names and illustrative identifiers do not prove intent or downstream activity.

{
  "authorization": {
    "action": "Microsoft.Compute/virtualMachines/write",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-draco-666"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud"
  },
  "correlationId": "90000000-0000-4000-8000-000010110100",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000010110101",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T22:34:08.5172938Z",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000010110110",
  "operationName": {
    "value": "Microsoft.Compute/virtualMachines/write",
    "localizedValue": "Create or Update Virtual Machine"
  },
  "resourceGroupName": "rg-fantasticlogs-prod",
  "resourceProviderName": {
    "value": "Microsoft.Compute",
    "localizedValue": "Microsoft.Compute"
  },
  "resourceType": {
    "value": "Microsoft.Compute/virtualMachines",
    "localizedValue": "Microsoft.Compute/virtualMachines"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-draco-666",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "Created",
    "localizedValue": "Created (HTTP Status Code: 201)"
  },
  "submissionTimestamp": "2026-04-15T22:34:09.0218732Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "Created",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-draco-666",
    "message": "Microsoft.Compute/virtualMachines/write",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": [],
  "httpRequest": {
    "clientRequestId": "90000000-0000-4000-8000-000010110111",
    "clientIpAddress": "203.0.113.66",
    "method": "PUT",
    "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-draco-666?api-version=2024-03-01"
  },
  "identity": null
}

Sources

same service (Azure - Compute)
Microsoft.Compute/disks/beginGetAccess/action Microsoft.Compute/snapshots/beginGetAccess/action Microsoft.Compute/sshPublicKeys/write Microsoft.Compute/virtualMachines/delete Microsoft.Compute/virtualMachines/extensions/write Microsoft.Compute/virtualMachines/runCommand/action Microsoft.SerialConsole/serialPorts/connect/action
Documentation reviewed: October 5, 2026. Samples are synthetic illustrations, not captured production logs or lab-validated fixtures.