Suspicious Azure VM Extension Installation
This rule detects the installation of suspicious extensions on Azure Virtual Machines. These extensions, such as CustomScriptExtension, RunCommandHandler, DSCExtension, AADLoginForWindows, and NetworkWatcherAgent, can be abused by attackers for various purposes including remote code execution, configuration manipulation, unauthorized account access, or network reconnaissance. Monitoring their installation can help identify potential compromise or malicious activity within an Azure environment.
Cortex XDR
