Azure VM RunCommand Activity
This rule detects activity related to Azure VM RunCommand, which allows execution of scripts on virtual machines without requiring RDP/SSH access. It specifically looks for 'WRITE', 'ACTION', 'DELETE', and 'READ' operations, filtering for successful or accepted statuses and valid identities. This activity can indicate an attacker executing commands or performing post-execution cleanup.
Cortex XDR
