Azure VM Command Execution using Third-Party Extensions – Salt Minion

Azure pentesting technique: abuse the Desired State Configuration (DSC) VM extension to run arbitrary commands with built-in recurrence, giving Contributor-role attackers stealthy persistence.

NetSPI shows how attackers can persist in Azure after privilege escalation using Automation Accounts, privileged runbooks, and webhook triggers that restore Owner access with a single POST request.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

With extensions/write, an attacker can point the Chef extension at a rogue Chef server for stealthy command execution and persistence on Azure VMs disguised as routine configuration management.

Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.