AVD Under Attack: Forensics in Hijacked Azure Virtual Desktop Sessions
12.07.2026 cloud-forensikazurevdilateral-movement
Virtual Desktop Infrastructure has long been sold as a convenience feature for remote work – a place where users comfortably access corporate resources without IT teams worrying about endpoint compliance. That very convenience is what now makes Azure Virtual Desktop (AVD) an attractive target for attackers. Microsoft’s own incident response team is seeing it in current engagements: threat actors are exploiting AVD deployments for lateral movement and persistence, hijacking legitimate AVD user accounts to gain what is essentially a trusted “endpoint” inside the network without having to install malware.
A Crime Scene Without a Weapon
What makes these attacks so forensically challenging is that there is often no classic payload to find. In one case documented by Microsoft, threat actors compromised identities, leveraged their AVD sessions, and pivoted into on-premises resources using the AVD virtual machine as a steppingstone to RDP into other machines for lateral movement. In another, a threat actor accessed the browser in AVD to search internal SharePoint sites for sensitive data and intellectual property. The consequence: this enables threat actors to perform identity discovery, pivot across cloud/on-premises boundaries, exfiltrate data, and stage ransomware operations, emphasizing the necessity for robust logging, monitoring, and least-privilege configurations in virtual desktop environments.
The picture is compounded by structural weaknesses in the platform itself. A 2025 privilege escalation flaw in Azure Automation illustrated how a low-privileged attacker could theoretically eavesdrop on other users’ sessions, tamper with audit logs, or plant persistent backdoors inside AVD environments – scenarios that map directly onto documented MITRE ATT&CK tactics.
Three Layers, One Vanishing Target
Investigating an AVD incident means working across three parallel layers: identity, Azure platform, and host/endpoint artifacts – each layer provides unique signals and telemetry that, when correlated, help uncover malicious activity and reduce dwell time. The real challenge, however, lies in the architecture itself: session hosts are often ephemeral – frequently spun up and deallocated – so offline evidence such as event logs or memory artifacts can be lost quickly without proactive collection. Where FSLogix is used for profile management, browsing history, NTUSER.DAT registry hives, and other user-specific traces don’t live on the host at all – they sit in VHD containers on remote storage, a detail most classic IR playbooks simply don’t account for.
Being prepared means enabling the right diagnostic logs before an incident happens. For threat hunting, the most relevant log tables are: WVDFeeds, showing which published applications were available including ClientIP and ClientType details; WVDConnections, listing Client IP address, connection type, resource alias, and host connection data; and WVDCheckpoints, indicating which published application was accessed and supplying its execution path. Without these logs, investigators are often left reconstructing events purely from identity provider data – a far blurrier picture.
For actual evidence acquisition, Microsoft recommends a clear priority order: live versus offline collection – live collection can recover volatile data like memory but might miss user profile content when FSLogix is in use, in which case investigators should focus on offline acquisition by generating a snapshot of the relevant disk or file share and downloading the associated VHD. Tools like Velociraptor for remote collection and Autopsy for disk forensics are used alongside traditional timelining utilities.
Takeaway for Practitioners
AVD forensics demands a mindset shift: away from hunting malicious binaries and toward correlating identity, platform, and session telemetry across multiple, often short-lived systems. Organizations running VDI environments should proactively enable diagnostic logging for host pools, application groups, and workspaces, integrate FSLogix storage into their IR playbooks, and, where licensing allows, evaluate session recording for highly sensitive environments. Waiting until an incident is underway to start logging means the evidence is already gone.
← Back to overview