Potential Azure VM Admin Password reset using VMAccess extension

JsonVMAccessExtension.exe refers to the VMAccess Extension that can reset the Built-in administrator account/add new accounts. This applies to any Azure VM/AVD

Detection Query

//JsonVMAccessExtension.exe refers to the VMAccess Extension that can reset the Built-in administrator account/add new accounts. This applies to any Azure VM/AVD
//Ref: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/reset-rdp#reset-the-local-admin-account-password
DeviceEvents
| where TimeGenerated >ago(90d)
//| where AdditionalFields.PipeName == "\\Device\\NamedPipe\\wkssvc" or AdditionalFields.PipeName == "\\Device\\NamedPipe\\srvsvc"
| where AdditionalFields.RemoteClientsAccess == "AcceptRemote" 
| where InitiatingProcessCommandLine == "JsonVMAccessExtension.exe  \"enable\"" //Azure VM account Extension
| where InitiatingProcessAccountName == "system" //Extension runs as system

Tags