Azure Run Command Script Child Process

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Azure Run Command Script Child Process

Identifies process start events whose parent matches Azure Virtual Machine Run Command execution patterns on Windows or Linux. On Windows, Run Command often launches PowerShell with -ExecutionPolicy Unrestricted and a script?.ps1 file; on Linux, the Azure Linux Agent (waagent) runs downloaded script.sh under "/var/lib/waagent/run-command/". Child process telemetry exposes the on-guest payload that cloud activity logs do not fully describe.

Rule type: eql

Rule indices:

logs-endpoint.events.process*
logs-windows.sysmon_operational-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Domain: Endpoint
OS: Linux
OS: Windows
Use Case: Threat Detection
Tactic: Execution
Data Source: Elastic Defend
Data Source: Sysmon
Data Source: Azure
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Azure Run Command Script Child Process

Azure VM Run Command executes scripts on guests without interactive RDP or SSH. On Windows, a parent PowerShell process with -ExecutionPolicy Unrestricted -File script?.ps1 often precedes child utilities; on Linux, waagent invokes /var/lib/waagent/run-command/download/*/script.sh via bash, sh, or dash.

Correlate with logs-azure.activitylogs-* for MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION when available.

Possible investigation steps

Review process.command_line, process.name, and process.parent.command_line or process.parent.args.
Confirm whether the host is an Azure VM and whether Run Command was expected for that asset.
Pivot on host.name or host.id for other suspicious process or network activity in the same window.

False positive analysis

Extension handlers, guest configuration, and patch orchestration may use the same parent patterns.
Exclude known automation hosts or script paths after validating with platform teams.

Response and remediation

If unauthorized, review Azure RBAC on the VM and subscription, revoke compromised credentials, and isolate the guest.
Collect endpoint artifacts and Azure activity logs for incident reporting.

Rule query

edit

process where event.type in ("start", "process_started") and
  (
    (process.parent.name == "powershell.exe" and
      process.parent.command_line like "powershell  -ExecutionPolicy Unrestricted -File script?.ps1") or
    (process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
      process.parent.args like "/var/lib/waagent/run-command/download/*/script.sh")
  )

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Technique:
- Name: Command and Scripting Interpreter
- ID: T1059
- Reference URL: https://attack.mitre.org/techniques/T1059/
Sub-technique:
- Name: PowerShell
- ID: T1059.001
- Reference URL: https://attack.mitre.org/techniques/T1059/001/
Sub-technique:
- Name: Unix Shell
- ID: T1059.004
- Reference URL: https://attack.mitre.org/techniques/T1059/004/
Technique:
- Name: Cloud Administration Command
- ID: T1651
- Reference URL: https://attack.mitre.org/techniques/T1651/

« Suspicious Instance Metadata Service (IMDS) API Request Azure Run Command Correlated with Process Execution »