Azure VM Run Command Usage for IMDS Token

Ibrahim Saud@tektrix

•updated Jun 18, 2026•5•0•16

Detects the use of Azure VM Run Command to execute PowerShell scripts that attempt to retrieve workload identity tokens from the Azure Instance Metadata Service (IMDS) endpoint. This activity could indicate an attacker attempting to steal credentials or escalate privileges within the Azure environment.