# Detective Controls Testing

Published articles for Detective Controls Testing.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Azure VM Command Execution using Third-Party Extensions - Salt Minion

DevFeed: [Azure VM Command Execution using Third-Party Extensions - Salt Minion](<https://devfeed.tech/articles/azure-vm-command-execution-using-third-party-extensions-salt-minion-54735.md>)

Original publisher: [Read original article](<https://www.netspi.com/blog/technical-blog/cloud-pentesting/azure-vm-command-execution-using-third-party-extensions-part-2/>)

Author: Thomas Byrne

Published: 2026-07-27T20:01:07Z

Content type: article

Language: en

Sources: [NetSPI](<https://devfeed.tech/sources/netspi.md>)

Topics: [Azure](<https://devfeed.tech/topics/azure.md>), [Extension](<https://devfeed.tech/topics/extension.md>), [Code](<https://devfeed.tech/topics/code.md>), [Automation](<https://devfeed.tech/topics/automation.md>), [remote access](<https://devfeed.tech/topics/remote-access.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [automation](<https://devfeed.tech/tags/automation.md>), [azure](<https://devfeed.tech/tags/azure.md>), [azure-virtual-machines](<https://devfeed.tech/tags/azure-virtual-machines.md>), [cloud-pentesting](<https://devfeed.tech/tags/cloud-pentesting.md>), [code](<https://devfeed.tech/tags/code.md>), [detective-controls-testing](<https://devfeed.tech/tags/detective-controls-testing.md>), [execution](<https://devfeed.tech/tags/execution.md>), [extensions](<https://devfeed.tech/tags/extensions.md>), [linux](<https://devfeed.tech/tags/linux.md>), [powershell](<https://devfeed.tech/tags/powershell.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This article explains how attackers can abuse legitimate third-party extensions on Azure Virtual Machines to execute arbitrary code and maintain remote access. It focuses on deploying a Salt Minion extension connected to a rogue Salt Master, including the attack setup, malicious Salt state, and execution across Linux and Windows virtual machines.

### Source excerpt

In part two of our series, learn how attackers can leverage this legitimate tool to achieve undetected, arbitrary code execution as root, and explore the key detection methods you need to protect your Linux and Windows environments. The post Azure VM Command Execution using Third-Party Extensions - Salt Minion appeared first on NetSPI.

## Azure VM Command Execution using Third-Party Extensions - Chef

DevFeed: [Azure VM Command Execution using Third-Party Extensions - Chef](<https://devfeed.tech/articles/azure-vm-command-execution-using-third-party-extensions-chef-54736.md>)

Original publisher: [Read original article](<https://www.netspi.com/blog/technical-blog/cloud-pentesting/azure-vm-command-execution-using-third-party-extensions/>)

Author: Thomas Byrne

Published: 2026-07-21T20:07:31Z

Content type: article

Language: en

Sources: [NetSPI](<https://devfeed.tech/sources/netspi.md>)

Topics: [Azure](<https://devfeed.tech/topics/azure.md>), [Extension](<https://devfeed.tech/topics/extension.md>), [execution](<https://devfeed.tech/topics/execution.md>), [configuration-management](<https://devfeed.tech/topics/configuration-management.md>), [remote access](<https://devfeed.tech/topics/remote-access.md>), [cloud-infrastructure](<https://devfeed.tech/topics/cloud-infrastructure.md>)

Tags: [azure](<https://devfeed.tech/tags/azure.md>), [azure-marketplace](<https://devfeed.tech/tags/azure-marketplace.md>), [azure-virtual-machines](<https://devfeed.tech/tags/azure-virtual-machines.md>), [chef](<https://devfeed.tech/tags/chef.md>), [cloud-pentesting](<https://devfeed.tech/tags/cloud-pentesting.md>), [configuration-management](<https://devfeed.tech/tags/configuration-management.md>), [detective-controls-testing](<https://devfeed.tech/tags/detective-controls-testing.md>), [execution](<https://devfeed.tech/tags/execution.md>), [extensions](<https://devfeed.tech/tags/extensions.md>), [remote-access](<https://devfeed.tech/tags/remote-access.md>)

### AI overview

This technical security post explains how privileged Azure principals can abuse legitimate third-party VM extensions, particularly Chef, to execute arbitrary commands and maintain remote access. It focuses on deploying malicious Chef configurations and extracting managed identity tokens.

### Source excerpt

Discover how a privileged principal in Azure can abuse third-party extensions like Chef to achieve arbitrary command execution on target VMs by deploying malicious cookbooks to extract Managed Identity tokens. The post Azure VM Command Execution using Third-Party Extensions - Chef appeared first on NetSPI.