Loading

Azure Run Command Script Child Process

Identifies process start events whose parent matches Azure Virtual Machine Run Command execution patterns on Windows or Linux. On Windows, Run Command often launches PowerShell with -ExecutionPolicy Unrestricted and a script?.ps1 file; on Linux, the Azure Linux Agent (waagent) runs downloaded script.sh under "/var/lib/waagent/run-command/". Child process telemetry exposes the on-guest payload that cloud activity logs do not fully describe.

Rule type: eql
Rule indices:

  • logs-endpoint.events.process*
  • logs-windows.sysmon_operational-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Domain: Endpoint
  • OS: Linux
  • OS: Windows
  • Use Case: Threat Detection
  • Tactic: Execution
  • Data Source: Elastic Defend
  • Data Source: Sysmon
  • Data Source: Azure
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

Azure VM Run Command executes scripts on guests without interactive RDP or SSH. On Windows, a parent PowerShell process with -ExecutionPolicy Unrestricted -File script?.ps1 often precedes child utilities; on Linux, waagent invokes /var/lib/waagent/run-command/download/*/script.sh via bash, sh, or dash.

Correlate with logs-azure.activitylogs-* for MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION when available.

  • Review process.command_line, process.name, and process.parent.command_line or process.parent.args.
  • Confirm whether the host is an Azure VM and whether Run Command was expected for that asset.
  • Pivot on host.name or host.id for other suspicious process or network activity in the same window.
  • Extension handlers, guest configuration, and patch orchestration may use the same parent patterns.
  • Exclude known automation hosts or script paths after validating with platform teams.
  • If unauthorized, review Azure RBAC on the VM and subscription, revoke compromised credentials, and isolate the guest.
  • Collect endpoint artifacts and Azure activity logs for incident reporting.
process where event.type in ("start", "process_started") and
  (
    (process.parent.name == "powershell.exe" and
      process.parent.command_line like "powershell  -ExecutionPolicy Unrestricted -File script?.ps1") or
    (process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
      process.parent.args like "/var/lib/waagent/run-command/download/*/script.sh")
  )

Framework: MITRE ATT&CK