Azure Virtual Machine Extension Used to Deploy Remote Access
Detects installation or update of a VM extension whose settings invoke scripts, remote support tooling, or command execution outside standard configuration management. This could indicate an adversary establishing persistence or remote access.
Microsoft Sentinel (KQL)
