Azure VM Command Execution via a Third-Party Salt Minion Extension

Summary

An attacker with Microsoft.Compute/virtualMachines/extensions/write permissions can abuse legitimate third-party extensions to execute arbitrary code on Azure VMs. By deploying the Salt Minion extension and connecting it to a rogue Salt Master, the attacker can push malicious states to targeted systems and gain root or SYSTEM-level access. This technique enables stealthy command execution that can blend with normal administrative automation.

Investigation

The report presents a proof-of-concept attack in which a rogue Salt Master is configured to control Azure VMs. The investigation shows how the Salt Minion extension is deployed through the Azure CLI and configured to communicate over ports 4505 and 4506. Researchers then execute a malicious Salt state that uses curl to exfiltrate Managed Identity tokens to an out-of-band interaction service.

Mitigation

Organizations should tightly restrict roles that include extension write permissions, including Owner, Contributor, and Virtual Machine Contributor. Applying the principle of least privilege is essential to prevent unauthorized extension deployment. Security teams should also monitor Azure Activity Logs for suspicious virtual machine extension write operations and unexpected third-party extension installations.

Response

If this activity is detected, security teams should immediately revoke the permissions of the identity responsible for deploying the extension. Review Azure Activity Logs to determine the source IP address, affected VM, and extension configuration. Perform endpoint forensics on the compromised system to assess command execution, identify stolen credentials, and detect any unauthorized persistence.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained sufficient permissions within the Azure Tenant (e.g., via a compromised Service Principal or User Account with ‘Virtual Machine Contributor’ roles). To establish a foothold and execute commands directly on a target VM without traditional SSH/RDP access, the adversary chooses to deploy a “Custom Script Extension.” This technique is highly effective for bypassing endpoint-based network controls. The adversary will execute an Azure CLI command to ‘write’ a new extension to the target VM. This action will trigger the MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE operation in the Azure Activity Logs, which is the exact telemetry our detection rule is designed to catch.

• Regression Test Script:

  # Simulation: Deploying a dummy extension to trigger the 'EXTENSIONS/WRITE' detection logic
  # Replace variables with your actual test environment values
  RESOURCE_GROUP="TestRG"
  VM_NAME="TestVM"
  EXTENSION_NAME="MaliciousSaltMinionSim"
  
  echo "Starting simulation: Deploying extension $EXTENSION_NAME to $VM_NAME..."
  
  az vm extension set 
    --resource-group $RESOURCE_GROUP 
    --vm-name $VM_NAME 
    --name $EXTENSION_NAME 
    --publisher Microsoft.Azure.Extensions 
    --settings '{"commandToExecute": "echo "Simulation Successful" > /tmp/pwned.txt"}'
  
  echo "Simulation command sent. Check Azure Activity Logs for MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE"

• Cleanup Commands:

  # Cleanup: Remove the simulated malicious extension to return the environment to its original state
  RESOURCE_GROUP="TestRG"
  VM_NAME="TestVM"
  EXTENSION_NAME="MaliciousSaltMinionSim"
  
  echo "Cleaning up: Removing extension $EXTENSION_NAME..."
  
  az vm extension delete 
    --resource-group $RESOURCE_GROUP 
    --vm-name $VM_NAME 
    --name $EXTENSION_NAME
  
  echo "Cleanup complete."