Azure VM Command Execution using Third-Party Extensions – Chef

Azure pentesting technique: abuse the Desired State Configuration (DSC) VM extension to run arbitrary commands with built-in recurrence, giving Contributor-role attackers stealthy persistence.

NetSPI shows how attackers can persist in Azure after privilege escalation using Automation Accounts, privileged runbooks, and webhook triggers that restore Owner access with a single POST request.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

With the extensions/write permission, an attacker can deploy the Salt Minion extension pointed at a rogue Salt Master and push arbitrary states to an Azure VM as root over ZeroMQ ports 4505/4506.

Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.