Azure Bastion Direct VM Connection for Lateral Movement

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects HTTP POST requests to 'management.azure.com' with a URI containing 'bastionHosts'. This pattern indicates an attempt to establish a direct VM connection via Azure Bastion, which could be used for lateral movement within an Azure environment.