ion" title="Permanent link">#</a></h1>
<p>By utilizing the 'Desired State Configuration extension' extension on a Virtual Machine, an attacker can pass PowerShell commands to the VM as SYSTEM.</p>
<div class="admonition info">
<p class="admonition-title">Resource</p>
<ul>
<li>Virtual Machine</li>
<li>Virtual Machine Scale Sets</li>
</ul>
</div>
<div class="admonition success">
<p class="admonition-title">Actions</p>
<ul>
<li>Microsoft.Compute/virtualMachines/extensions/*</li>
<li>Microsoft.Compute/virtualMa