​
Event Information

  • The Microsoft.Compute.images.write event in Azure for AzureVirtualMachines refers to the action of creating or updating a custom image in Azure.
  • This event is triggered when a user or an automated process initiates the creation or modification of a custom image for virtual machines in Azure.
  • It indicates that changes are being made to an existing image or a new image is being created, which can be used to provision new virtual machines with the desired configuration and software setup.

​
Examples

  1. Unauthorized access to image creation: If security is impacted with Microsoft.Compute.images.write, it could potentially allow unauthorized users to create or modify images for Azure Virtual Machines. This could lead to the creation of compromised or malicious images that can be used to launch instances with unauthorized access or perform unauthorized actions within the virtual machines.

  2. Image tampering: Security can be impacted if an attacker gains access to the Microsoft.Compute.images.write permission. They could potentially tamper with existing images, modifying their contents or injecting malicious code. This can result in compromised virtual machines being launched from these tampered images, leading to data breaches, unauthorized access, or other security incidents.

  3. Image distribution vulnerabilities: Microsoft.Compute.images.write permission allows users to create and distribute custom images for Azure Virtual Machines. If security is impacted, it could enable attackers to distribute malicious images to unsuspecting users. These images may contain vulnerabilities or backdoors that can be exploited to gain unauthorized access or compromise the security of the virtual machines running on Azure.

​
Remediation

​
Using Console

To remediate the issues for Azure Virtual Machines using the Azure console, you can follow these step-by-step instructions:

  1. Enable Azure Security Center:

    • Go to the Azure portal and search for “Security Center” in the search bar.
    • Select “Security Center” from the results and click on it.
    • In the Security Center dashboard, click on “Pricing & settings” in the left menu.
    • Choose the subscription and resource group where your Azure Virtual Machines are located.
    • Click on “Apply to all resources” to enable Security Center for all resources in the selected subscription and resource group.
    • Review the pricing tier options and select the appropriate tier for your needs.
    • Click on “Save” to enable Security Center.

  2. Implement Network Security Groups (NSGs):

    • Go to the Azure portal and search for “Virtual machines” in the search bar.
    • Select “Virtual machines” from the results and click on it.
    • Choose the virtual machine you want to secure and click on it.
    • In the virtual machine’s overview page, click on “Networking” in the left menu.
    • Under “Inbound port rules” and “Outbound port rules”, review the existing rules and remove any unnecessary open ports.
    • Click on “Add inbound port rule” or “Add outbound port rule” to add specific rules for required ports.
    • Configure the rules based on your application’s needs and security requirements.
    • Click on “Save” to apply the NSG rules to the virtual machine.

  3. Implement Azure Backup:

    • Go to the Azure portal and search for “Recovery Services vaults” in the search bar.
    • Select “Recovery Services vaults” from the results and click on it.
    • Click on “Add” to create a new Recovery Services vault.
    • Provide the required details like subscription, resource group, and vault name.
    • Choose the appropriate region for the vault.
    • Click on “Review + create” and then “Create” to create the vault.
    • Once the vault is created, go to the virtual machine’s overview page.
    • Click on “Backup” in the left menu.
    • Click on “Backup now” to initiate an immediate backup of the virtual machine.
    • Configure the backup settings like retention policy and backup frequency.
    • Click on “Enable backup” to start the backup process.

These steps will help you remediate the mentioned issues for Azure Virtual Machines using the Azure console.

​
Using CLI

To remediate the issues for Azure Virtual Machines using Azure CLI, you can follow these steps:

  1. Enable Azure Security Center for Azure Virtual Machines:

    • Use the Azure CLI command az vm update --name <vm_name> --resource-group <resource_group_name> --set "properties.securityProfile.securityCenterEnabled=true" to enable Azure Security Center for a specific virtual machine.

  2. Configure Network Security Groups (NSGs) for Azure Virtual Machines:

    • Use the Azure CLI command az network nsg rule create --name <rule_name> --nsg-name <nsg_name> --resource-group <resource_group_name> --priority <priority_number> --source-address-prefixes <source_address_prefix> --destination-port-ranges <destination_port_range> --access <access_type> --protocol <protocol> to create a new NSG rule for a specific NSG and virtual machine.

  3. Implement Azure Backup for Azure Virtual Machines:

    • Use the Azure CLI command az backup protection enable-for-vm --vm <vm_name> --resource-group <resource_group_name> --policy-name <policy_name> to enable Azure Backup protection for a specific virtual machine. Replace <policy_name> with the name of the backup policy you want to apply.

Please note that the actual values for <vm_name>, <resource_group_name>, <rule_name>, <nsg_name>, <priority_number>, <source_address_prefix>, <destination_port_range>, <access_type>, and <protocol> should be replaced with the appropriate values specific to your environment.

​
Using Python

To remediate the issues for Azure Virtual Machines using Python, you can use the Azure SDK for Python. Here are three examples of how you can remediate specific issues:

  1. Example 1: Enabling Azure Disk Encryption for Virtual Machines
    • Install the required package: pip install azure-mgmt-compute
    • Use the following Python script to enable Azure Disk Encryption for a specific virtual machine:
from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()

# Provide your Azure subscription ID and resource group name
subscription_id = 'your_subscription_id'
resource_group_name = 'your_resource_group_name'

# Provide the name of the virtual machine
vm_name = 'your_vm_name'

# Create the ComputeManagementClient
compute_client = ComputeManagementClient(credential, subscription_id)

# Enable Azure Disk Encryption for the virtual machine
compute_client.virtual_machines.begin_enable_disk_encryption(resource_group_name, vm_name)
  1. Example 2: Resizing a Virtual Machine
    • Install the required package: pip install azure-mgmt-compute
    • Use the following Python script to resize a specific virtual machine:
from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()

# Provide your Azure subscription ID and resource group name
subscription_id = 'your_subscription_id'
resource_group_name = 'your_resource_group_name'

# Provide the name of the virtual machine
vm_name = 'your_vm_name'

# Provide the new size for the virtual machine
new_vm_size = 'Standard_DS2_v2'

# Create the ComputeManagementClient
compute_client = ComputeManagementClient(credential, subscription_id)

# Resize the virtual machine
compute_client.virtual_machines.begin_update(resource_group_name, vm_name, {'hardware_profile': {'vm_size': new_vm_size}})
  1. Example 3: Applying Network Security Group Rules to a Virtual Machine
    • Install the required package: pip install azure-mgmt-network
    • Use the following Python script to apply network security group rules to a specific virtual machine:
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()

# Provide your Azure subscription ID and resource group name
subscription_id = 'your_subscription_id'
resource_group_name = 'your_resource_group_name'

# Provide the name of the virtual machine
vm_name = 'your_vm_name'

# Provide the name of the network security group
nsg_name = 'your_nsg_name'

# Provide the priority and rule details
rule_priority = 100
rule_name = 'AllowSSH'
rule_protocol = 'Tcp'
rule_source_address_prefix = '*'
rule_destination_port_range = '22'

# Create the NetworkManagementClient
network_client = NetworkManagementClient(credential, subscription_id)

# Get the network interface associated with the virtual machine
network_interface = network_client.network_interfaces.get(resource_group_name, vm_name)

# Get the network security group associated with the network interface
network_security_group = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Create the security rule
security_rule = {
    'name': rule_name,
    'protocol': rule_protocol,
    'source_address_prefix': rule_source_address_prefix,
    'destination_port_range': rule_destination_port_range,
    'priority': rule_priority
}

# Add the security rule to the network security group
network_security_group.security_rules.append(security_rule)

# Update the network security group
network_client.network_security_groups.begin_create_or_update(resource_group_name, nsg_name, network_security_group)

Please note that you need to replace the placeholders (your_subscription_id, your_resource_group_name, your_vm_name, your_nsg_name, etc.) with the actual values specific to your Azure environment.