Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Custom Script Extension

An Azure VM extension that downloads files and runs a command on the VM, installed through Microsoft.Compute/virtualMachines/extensions/write.

The Custom Script Extension downloads files from fileUris and runs commandToExecute on an Azure VM — Microsoft.Compute / CustomScriptExtension on Windows (running as LocalSystem), Microsoft.Azure.Extensions / CustomScript on Linux (Windows, Linux).

It is installed with extensions/write, visible in the Activity Log. The command may sit in clear-text settings or encrypted protectedSettings. Downloaded files and output stay on the VM, under the extension's plugin folders, which makes the disk the key evidence source.

See Azure Run Command attacks.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.