Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Run Command (Azure VM)

An Azure VM feature that runs a script on the guest through the VM agent — as SYSTEM on Windows — without network access to the VM.

Run Command executes a PowerShell or shell script inside an Azure VM through the VM agent. Microsoft documents that scripts run as System on Windows and as an elevated user on Linux, that the caller needs Microsoft.Compute/virtualMachines/runCommand/action, and that no RDP or SSH access is required (Microsoft Learn).

The Activity Log records who ran it, when and from where, but generally not the script, which must be recovered from the VM. MITRE ATT&CK tracks it as T1651 Cloud Administration Command.

See Azure Run Command attacks.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.