SOP-45: Azure VM RunCommand Abuse Response
SOC analyst SOP for Azure VM RunCommand abuse for remote code execution and lateral movement. Covers management-plane RCE, persistence via extensions, and forensic collection.
Rudra Verma, Senior Security Architect & Researcher