Azure VM Run Command Followed by Managed Identity Token Acquisition

Tim Peck@timpeck

•updated Feb 10, 2026•12•1•162

Detects when a VM Run Command is executed successfully, followed by the VM's Managed Identity authenticating to Azure Resource Manager. This pattern may indicate an attacker using Run Command to steal MI tokens for lateral movement.