The expendable extension name: Azure VMAccess naming chaos, password resets, and a detection gap

In early April, the Sysdig Threat Research Team (TRT) identified a detection flaw in the process for Azure VM password resets and VMAccess naming. This flaw allows attackers to assign any name to Azure VM extensions, giving them the ability to obtain read/write access, change passwords, and persist in the victim environment without being detected. Additionally, the Sysdig TRT found that the telemetry documented by the Azure Threat Matrix for this detection did not fire when the event was triggered. We promptly reported these issues to Microsoft upon identification. Their official response is: “Upon investigation, we have determined that this is not considered a security vulnerability because resource names are always user specified.“ This report details the Sysdig TRT’s findings and explores detection recommendations. Azure VM extensions are programs that run on virtual machines to perform post-deployment configuration and management tasks. They execute with elevated privileges on…