Suspicious Child Process via Azure VM CustomScript Extension

[metadata]
creation_date = "2026/06/17"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/06/17"

[rule]
author = ["Elastic"]
description = """
Identifies a suspicious process executing as a descendant of the Azure VM CustomScript extension handler
(CustomScriptHandler.exe) on a Windows host. The Azure CustomScript extension runs an attacker-supplied script with high
privilege (SYSTEM) via the guest agent, and is a common cloud-to-host code-execution and persistence primitive. Because
the extension's resource name is attacker-controlled and absent from on-host telemetry, this rule anchors on the
type-bearing handler binary ('Microsoft.Compute.CustomScriptExtension\\...\\CustomScriptHandler.exe') rather than the
spoofable extension name, making it resistant to renaming. CustomScript legitimately launches PowerShell and cmd, so the
rule fires only when the descendant is an execution-proxy, download, or discovery LOLBin, or PowerShell exhibiting
suspicious tradecraft.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Child Process via Azure VM CustomScript Extension"
note = """## Triage and analysis

### Investigating Suspicious Child Process via Azure VM CustomScript Extension

The Azure CustomScript extension executes a script as SYSTEM via the guest agent. The extension's resource name is
attacker-controlled and not present on the host, so this rule anchors on the handler binary path
(`Microsoft.Compute.CustomScriptExtension\\...\\CustomScriptHandler.exe`), which is rename-proof, and alerts when a
LOLBin or suspicious PowerShell runs anywhere in its process tree.

### Possible investigation steps

- Review the full process tree from `CustomScriptHandler.exe` to the alerting process, including `process.command_line`
  and `process.args`.
- Identify the descendant: execution proxies (`mshta`, `regsvr32`, `rundll32`, `installutil`, `msbuild`), download tools
  (`certutil`, `bitsadmin`), script hosts (`wscript`, `cscript`), or discovery utilities (`whoami`, `net`, `nltest`,
  `wmic`) are not expected children of a benign CustomScript payload.
- Correlate with the control-plane event: a `MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE` in
  `logs-azure.activitylogs-*` for this host around the same time, and the acting principal/source behind it.
- Retrieve the extension's settings/protectedSettings from the VM (the activity log does not contain the script body) to
  assess intent.
- Pivot on the host for credential access, new local accounts, persistence, or outbound C2 following the execution.
- Review who deployed the extension (Entra sign-in logs and RBAC for the principal in the correlated activity log event).

### False positive analysis

- Infrastructure-as-code and configuration-management scripts deployed via CustomScript may legitimately run discovery
  utilities (`whoami`, `net`, `nltest`, `systeminfo`, `wmic`, `tasklist`, `arp`) for bootstrap or inventory. If the
  activity recurs from known automation, baseline it and exclude by `process.command_line`/`process.args`.
- Software installation and bootstrapping via CustomScript can invoke `msbuild`, `installutil`, `regsvr32`, `regasm`,
  `regsvcs`, `certutil`, or `bitsadmin` to build, register, or download legitimate components. Verify the target
  file/URL and, if benign, scope the exclusion to the specific command or signed binary rather than the whole LOLBin.
- Legitimate setup scripts (DSC bootstrap, agent installers) may use PowerShell download cradles
  (`Invoke-WebRequest`, `DownloadString`, `-EncodedCommand`) against trusted internal or Microsoft endpoints. Confirm
  the destination host and content before excluding, and exclude by the specific command line, not by host.
- A known automation principal deploying the extension from expected corporate egress (corroborated by the correlated
  `MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE` and an approved change) lowers confidence, but still review the
  executed content. Prefer narrow, command- or argument-scoped exclusions over broad host or LOLBin exclusions, since
  the same execution chain is exactly what an attacker abuses.

### Response and remediation

- If unauthorized, remove the extension, isolate the host, rotate credentials reachable from it, and review RBAC on the affected subscription/resource group.
"""
references = [
    "https://blog.pwnedlabs.io/diving-deep-into-azure-vm-attack-vectors",
    "https://www.sysdig.com/blog/the-expendable-extension-name-azure-vmaccess-naming-chaos-password-resets-and-a-detection-gap",
    "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows",
]
risk_score = 47
rule_id = "b4d4f0fb-908e-4cd1-ac8f-795c0433db0a"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
sequence by host.id with maxspan=1m
  /* Azure CustomScript extension handler */
  [process where host.os.type == "windows" and event.type == "start" and
     (process.name : "CustomScriptHandler.exe" or
      process.executable : "?:\\Packages\\Plugins\\*CustomScript*\\*\\CustomScriptHandler.exe")] by process.entity_id
  /* Abused LOLBin / suspicious PowerShell anywhere in its tree */
  [process where host.os.type == "windows" and event.type == "start" and
   (
     process.name : ("mshta.exe", "regsvr32.exe", "rundll32.exe", "installutil.exe", "msbuild.exe", "regasm.exe",
                     "regsvcs.exe", "wscript.exe", "cscript.exe", "bitsadmin.exe", "nltest.exe", "whoami.exe",
                     "net.exe", "net1.exe", "wmic.exe", "systeminfo.exe", "quser.exe", "arp.exe", "tasklist.exe") or
     (process.name : "certutil.exe" and process.args : ("*urlcache*", "*-decode*", "*-encode*")) or
     (process.name : ("powershell.exe", "pwsh.exe") and
      process.command_line : ("*-enc*", "*EncodedCommand*", "*FromBase64String*", "*DownloadString*", "*DownloadFile*",
                              "*Invoke-Expression*", "*IEX *", "*IEX(*", "*|IEX*", "*-w hidden*", "*WindowStyle Hidden*",
                              "*Net.WebClient*", "*Invoke-WebRequest*", "*Start-BitsTransfer*"))
   )] by process.Ext.ancestry
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1651"
name = "Cloud Administration Command"
reference = "https://attack.mitre.org/techniques/T1651/"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"