Suspicious Command Execution via Azure RunCommand or Custom Script Extension

Shadows VMB@Vemorian_Mort

•updated yesterday•3•0•5

Detects suspicious command execution activities using Azure RunCommand, Custom Script Extension, or Azure Connected Machine Agent combined with potentially malicious command arguments or tools such as PowerShell encoded commands, 'IEX', download strings, certutil, whoami, base64, curl, or wget.