# Azure VM security

Published articles for Azure VM security.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## The expendable extension name: Azure VMAccess naming chaos, password resets, and a detection gap

DevFeed: [The expendable extension name: Azure VMAccess naming chaos, password resets, and a detection gap](<https://devfeed.tech/articles/the-expendable-extension-name-azure-vmaccess-naming-chaos-password-resets-and-a-detection-gap-53281.md>)

Original publisher: [Read original article](<https://webflow.sysdig.com/blog/the-expendable-extension-name-azure-vmaccess-naming-chaos-password-resets-and-a-detection-gap>)

Author: Lydia Graslie

Published: 2026-05-20T00:00:00Z

Content type: article

Language: en

Sources: [Sysdig Blog](<https://devfeed.tech/sources/sysdig-blog.md>)

Topics: [Azure](<https://devfeed.tech/topics/azure.md>), [Security & compliance, Cloud security](<https://devfeed.tech/topics/security-compliance-cloud-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [password reset](<https://devfeed.tech/topics/password-reset.md>), [Persistence](<https://devfeed.tech/topics/persistence.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [control-plane](<https://devfeed.tech/topics/control-plane.md>), [telemetry](<https://devfeed.tech/topics/telemetry.md>)

Tags: [alert](<https://devfeed.tech/tags/alert.md>), [azure](<https://devfeed.tech/tags/azure.md>), [azure-activity-log-detection](<https://devfeed.tech/tags/azure-activity-log-detection.md>), [azure-cloud-detection](<https://devfeed.tech/tags/azure-cloud-detection.md>), [azure-persistence-techniques](<https://devfeed.tech/tags/azure-persistence-techniques.md>), [azure-threat-detection](<https://devfeed.tech/tags/azure-threat-detection.md>), [azure-vm-extension-abuse](<https://devfeed.tech/tags/azure-vm-extension-abuse.md>), [azure-vm-extensions](<https://devfeed.tech/tags/azure-vm-extensions.md>), [azure-vm-password-reset](<https://devfeed.tech/tags/azure-vm-password-reset.md>), [azure-vm-security](<https://devfeed.tech/tags/azure-vm-security.md>), [azure-vmaccess](<https://devfeed.tech/tags/azure-vmaccess.md>), [cloud-control-plane-security](<https://devfeed.tech/tags/cloud-control-plane-security.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [control-plane](<https://devfeed.tech/tags/control-plane.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [falco](<https://devfeed.tech/tags/falco.md>), [password-reset](<https://devfeed.tech/tags/password-reset.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [security](<https://devfeed.tech/tags/security.md>), [telemetry](<https://devfeed.tech/tags/telemetry.md>)

### AI overview

The Sysdig Threat Research Team reports that Azure VM extension names can be freely assigned, allowing attackers to disguise VMAccess operations. The issue can enable password changes, read/write access, and persistence, while expected telemetry may fail to trigger.

### Source excerpt

In early April, the Sysdig Threat Research Team (TRT) identified a detection flaw in the process for Azure VM password resets and VMAccess naming. This flaw allows attackers to assign any name to Azure VM extensions, giving them the ability to obtain read/write access, change passwords, and persist in the victim environment without being detected. Additionally, the Sysdig TRT found that the telemetry documented by the Azure Threat Matrix for this detection did not fire when the event was triggered.