---
title: Azure Run Command Script Child Process
description: Identifies process start events whose parent matches Azure Virtual Machine Run Command execution patterns on Windows or Linux. On Windows, Run Command...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_azure_run_command_script_child_process
products:
  - Elastic Security
---

# Azure Run Command Script Child Process
Identifies process start events whose parent matches Azure Virtual Machine Run Command execution patterns on Windows
or Linux. On Windows, Run Command often launches PowerShell with `-ExecutionPolicy Unrestricted` and a `script?.ps1`
file; on Linux, the Azure Linux Agent (waagent) runs downloaded script.sh under "/var/lib/waagent/run-command/".
Child process telemetry exposes the on-guest payload that cloud activity logs do not fully describe.
**Rule type**: eql
**Rule indices**:
- logs-endpoint.events.process*
- logs-windows.sysmon_operational-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://docs.microsoft.com/en-us/azure/virtual-machines/run-command](https://docs.microsoft.com/en-us/azure/virtual-machines/run-command)](https://docs.microsoft.com/en-us/azure/virtual-machines/run-command)
- [[https://hackingthe.cloud/azure/run-command-abuse/](https://hackingthe.cloud/azure/run-command-abuse/)](https://hackingthe.cloud/azure/run-command-abuse/)

**Tags**:
- Domain: Cloud
- Domain: Endpoint
- OS: Linux
- OS: Windows
- Use Case: Threat Detection
- Tactic: Execution
- Data Source: Elastic Defend
- Data Source: Sysmon
- Data Source: Azure
- Resources: Investigation Guide
- Noise: Medium
- Performance: Normal
- Profile: Recommended
- Threat: Cloud VM Execution
- Rule Type: Event Correlation (EQL)
- Platform: Windows
- Platform: Linux

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating Azure Run Command Script Child Process

Azure VM Run Command executes scripts on guests without interactive RDP or SSH. On Windows, a parent PowerShell
process with `-ExecutionPolicy Unrestricted -File script?.ps1` often precedes child utilities; on Linux, `waagent`
invokes `/var/lib/waagent/run-command/download/*/script.sh` via `bash`, `sh`, or `dash`.
Correlate with `logs-azure.activitylogs-*` for `MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION` when available.

### Possible investigation steps

- Review `process.command_line`, `process.name`, and `process.parent.command_line` or `process.parent.args`.
- Confirm whether the host is an Azure VM and whether Run Command was expected for that asset.
- Pivot on `host.name` or `host.id` for other suspicious process or network activity in the same window.


### False positive analysis

- Extension handlers, guest configuration, and patch orchestration may use the same parent patterns.
- Exclude known automation hosts or script paths after validating with platform teams.


### Response and remediation

- If unauthorized, review Azure RBAC on the VM and subscription, revoke compromised credentials, and isolate the guest.
- Collect endpoint artifacts and Azure activity logs for incident reporting.


## Rule Query

```eql
process where event.type in ("start", "process_started") and
  (
    (process.parent.name == "powershell.exe" and
      process.parent.command_line like "powershell  -ExecutionPolicy Unrestricted -File script?.ps1") or
    (process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
      process.parent.args like "/var/lib/waagent/run-command/download/*/script.sh")
  )
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: Command and Scripting Interpreter
  - Id: T1059
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/](https://attack.mitre.org/techniques/T1059/)](https://attack.mitre.org/techniques/T1059/)
- Sub Technique:
  - Name: PowerShell
  - Id: T1059.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/001/](https://attack.mitre.org/techniques/T1059/001/)](https://attack.mitre.org/techniques/T1059/001/)
- Sub Technique:
  - Name: Unix Shell
  - Id: T1059.004
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/004/](https://attack.mitre.org/techniques/T1059/004/)](https://attack.mitre.org/techniques/T1059/004/)
- Technique:
  - Name: Cloud Administration Command
  - Id: T1651
  - Reference URL: [[https://attack.mitre.org/techniques/T1651/](https://attack.mitre.org/techniques/T1651/)](https://attack.mitre.org/techniques/T1651/)