---
id: 7668
title: "Azure VM Command Execution using Third-Party Extensions – Salt Minion"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/cloud-pentesting/azure-vm-command-execution-using-third-party-extensions-part-2/"
published_at: "2026-07-27T00:00:00Z"
tags: ["cloud", "cloud-security", "privilege-escalation", "red-team", "azure", "persistence", "salt-minion", "vm-extension"]
phying_url: "https://phying.com/item/7668"
lang: en
---

# Azure VM Command Execution using Third-Party Extensions – Salt Minion

## Summary

With the extensions/write permission, an attacker can deploy the Salt Minion extension pointed at a rogue Salt Master and push arbitrary states to an Azure VM as root over ZeroMQ ports 4505/4506.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2026-07-27T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/cloud-pentesting/azure-vm-command-execution-using-third-party-extensions-part-2/
- **Phying News:** https://phying.com/item/7668