services / Azure / Virtual Machines

An Azure virtual machine: a production compute resource running an OS, applications, attached disks, network interfaces, and optionally a managed identity.

A VM typically supports a single organizational function; control-plane and data-plane access to it can expose on-disk data, attached managed-identity credentials, and the hosted service's availability.

Microsoft.​Compute/​virtualMachines/​runCommand/​action

Run Command executes arbitrary scripts on the VM as SYSTEM/root, yielding code execution as the VM's managed identity (lateral movement), theft of on-disk data, in-guest tampering, and use of the host for attacker workloads.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Lateral movement (BOOST)
4. Resource hijacking (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links