Azure Managed Identity VM Run Command Execution

Ethan Andrews@eandrews

•updated Feb 11, 2026•6•0•61

This detection identifies when a Managed Identity (Service Principal) successfully executes a 'RunCommand' on an Azure virtual machine. This activity is a key indicator of lateral movement, where an attacker, having compromised a resource with a Managed Identity, uses that identity's permissions to execute code on another VM.