services / Azure / Virtual Machine in Scale Set

An individual virtual machine instance within an Azure Virtual Machine Scale Set, a production compute resource that runs application workloads and may carry an attached managed identity.

Production compute supporting a single organizational function; instances can hold managed identities and host application data on attached disks.

Microsoft.​Compute/​virtualMachineScaleSets/​virtualMachines/​diagnosticRunCommand/​action

Executes a diagnostic script inside the instance in its identity context, providing in-guest code execution enabling lateral movement via the managed identity, on-host data exfiltration, tampering, and compute hijacking.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Lateral movement (BOOST)
4. Resource hijacking (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links