AZVMContributor

The Virtual Machine contributor role grants almost all abusable privileges against Virtual Machines.

Abuse Info

The Virtual Machine Contributor role allows you to run SYSTEM commands on the VM

Via PowerZure:

• Invoke-AzureRunCommand
• Invoke-AzureRunMSBuild
• Invoke-AzureRunProgram

Opsec Considerations

Because you’ll be running a command as the SYSTEM user on the Virtual Machine, the same opsec considerations for running malicious commands on any system should be taken into account: command line logging, PowerShell script block logging, EDR, etc.

References

• https://blog.netspi.com/running-powershell-scripts-on-azure-vms/