C-AZ-RUNCOMMAND-VMLateral Movement

Azure VM RunCommand

VirtualMachines/runCommand/action runs scripts as SYSTEM on the target VM — relies only on RBAC, not OS login.

§ Where this technique fits

C-AZ-RUNCOMMAND-VM is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 5 on average.

§ Dossiers chaining this technique

Compromised VM → Managed Identity → Subscription Owner
A VM with an over-privileged system-assigned managed identity is compromised; query IMDS for an Azure AD token, then assign yourself Owner on the subscription.
step 5 / 5

§ Where this technique fits

§ Dossiers chaining this technique

Compromised VM → Managed Identity → Subscription Owner