Azure Managed Identity Executing VM Run Command

nomit vyas@xoxo

•updated Jun 22, 2026•2•0•7

This detection identifies when a Managed Identity (Service Principal) executes a 'RunCommand' on a virtual machine. This activity is a key indicator of lateral movement, where an attacker, having compromised a resource with a Managed Identity, uses that identity's permissions to execute code on another VM.