Azure Managed Identity Lateral Movement via Run Command

Daniel Jeremiah@daniyyell

•updated Feb 12, 2026•6•0•40

Detects potential lateral movement attempts within Azure by a Service Principal (Managed Identity) executing 'runCommand' or other compute operations on virtual machines. This activity could indicate an attacker abusing a compromised Managed Identity to gain access to and control other resources.