Azure VM Serial Console Connection with Unusual User and ASN

Last updated 13 days ago on 2026-06-07

Created 13 days ago on 2026-06-07

About

Identifies a connection to the Azure Serial Console of a virtual machine (VM) by an identity and source network combination that has not been observed recently. The Serial Console provides text-based console access to a VM through the boot diagnostics serial port, independent of the VM's network state. Because it does not traverse the VM's network interface, a Serial Console session bypasses Network Security Groups (NSGs), Just-in-Time (JIT) access policies, and other network controls. An adversary with a privileged Azure RBAC role (for example Virtual Machine Contributor) and boot diagnostics enabled on the target can use the Serial Console to obtain an interactive session as SYSTEM (Windows) or root (Linux).

Tags

Domain: CloudData Source: AzureData Source: Azure Activity LogsUse Case: Threat DetectionTactic: Lateral MovementTactic: Defense EvasionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Lateral Movement (TA0008)(external, opens in a new tab or window)

↳ Remote Services (T1021)(external, opens in a new tab or window)

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Valid Accounts (T1078)(external, opens in a new tab or window)

False Positive Examples

System or platform administrators may legitimately use the Serial Console to troubleshoot a VM that is unreachable over the network (boot failures, misconfigured firewall/NSG, lost SSH/RDP access). The first connection per identity and source ASN will alert; baseline expected break-glass principals and their corporate/VPN networks and exclude them if verified as authorized.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-azure.activitylogs-*
Related Integrations: azure(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:azure.activitylogs and
  azure.activitylogs.operation_name:"MICROSOFT.SERIALCONSOLE/SERIALPORTS/CONNECT/ACTION" and
  event.outcome:("success" or "Success") and
  azure.activitylogs.identity.authorization.evidence.principal_id:* and
  source.as.number:*

Install detection rules in Elastic Security

Detect Azure VM Serial Console Connection with Unusual User and ASN in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).