> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-bed-6715-managed-id-auth-method.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# AZVMContributor

> The Virtual Machine contributor role grants almost all abusable privileges against Virtual Machines.

<img noZoom src="https://mintcdn.com/specterops-bed-6715-managed-id-auth-method/32bGxo1_JbXAaHjs/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max&auto=format&n=32bGxo1_JbXAaHjs&q=85&s=bb5b2bc8331220b968a23923bc289c26" alt="Applies to BloodHound Enterprise and CE" width="482" height="45" data-path="assets/enterprise-AND-community-edition-pill-tag.svg" />

## Abuse Info

The Virtual Machine Contributor role allows you to run SYSTEM commands on the VM

Via PowerZure:

* [Invoke-AzureRunCommand](https://powerzure.readthedocs.io/en/latest/Functions/operational.html#invoke-azureruncommand)
* [Invoke-AzureRunMSBuild](https://powerzure.readthedocs.io/en/latest/Functions/operational.html#invoke-azurerunmsbuild)
* [Invoke-AzureRunProgram](https://powerzure.readthedocs.io/en/latest/Functions/operational.html#invoke-azurerunprogram)

## Opsec Considerations

Because you’ll be running a command as the SYSTEM user on the Virtual Machine, the same opsec considerations for running malicious commands on any system should be taken into account: command line logging, PowerShell script block logging, EDR, etc.

## References

* [https://blog.netspi.com/running-powershell-scripts-on-azure-vms/](https://blog.netspi.com/running-powershell-scripts-on-azure-vms/)