Azure Run Command Executed on Virtual Machine

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects HTTP traffic directed to 'management.azure.com' with a URI containing 'runCommand'. This pattern indicates an attempt to execute a command on an Azure Virtual Machine using the Azure Run Command feature. This activity is often associated with administrative actions or potential malicious execution on cloud resources.