---
title: Azure Virtual Machine Configuration Modified
description: Identifies a successful write to an Azure virtual machine resource ("MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE"). This operation is the parent action behind...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules_building_block/persistence_azure_vm_configuration_modified
products:
  - Elastic Security
---

# Azure Virtual Machine Configuration Modified
Identifies a successful write to an Azure virtual machine resource
("MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE"). This operation is the parent action behind VM userData injection, where an
adversary with VM contributor rights writes a base64 startup payload into the VM "userData" field that executes on the
next reboot (a control-plane persistence technique requiring no guest access). The Azure activity log does not record the
"userData" value or which property changed, so this behavior is indistinguishable from any other VM write at detection
time. This is a building block rule and does not generate alerts on its own; it captures the VM write population so it
can be correlated with other signals and baselined over time to tune a higher-fidelity userData-injection detection.
To investigate a candidate, retrieve the live "userData" from the VM with an Azure Resource Manager GET using "$expand=userData".
**Rule type**: query
**Rule indices**:
- logs-azure.activitylogs-*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://blog.pwnedlabs.io/diving-deep-into-azure-vm-attack-vectors](https://blog.pwnedlabs.io/diving-deep-into-azure-vm-attack-vectors)](https://blog.pwnedlabs.io/diving-deep-into-azure-vm-attack-vectors)
- [[https://learn.microsoft.com/en-us/azure/virtual-machines/user-data](https://learn.microsoft.com/en-us/azure/virtual-machines/user-data)](https://learn.microsoft.com/en-us/azure/virtual-machines/user-data)

**Tags**:
- Domain: Cloud
- Domain: Endpoint
- Data Source: Azure
- Data Source: Azure Activity Logs
- Use Case: Asset Visibility
- Tactic: Persistence
- Rule Type: BBR
- Rule Type: Custom Query (KQL)
- Platform: Azure

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Rule Query

```kuery
data_stream.dataset:azure.activitylogs and
    event.action:"MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE" and
    event.outcome:(success or Success)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Persistence
  - Id: TA0003
  - Reference URL: [[https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)](https://attack.mitre.org/tactics/TA0003/)
- Technique:
  - Name: Boot or Logon Initialization Scripts
  - Id: T1037
  - Reference URL: [[https://attack.mitre.org/techniques/T1037/](https://attack.mitre.org/techniques/T1037/)](https://attack.mitre.org/techniques/T1037/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: Cloud Administration Command
  - Id: T1651
  - Reference URL: [[https://attack.mitre.org/techniques/T1651/](https://attack.mitre.org/techniques/T1651/)](https://attack.mitre.org/techniques/T1651/)