Detects the first-time creation or update of an Azure VM extension on a VM or VM scale set within a 7-day lookback window, capturing high-privilege guest extensions used for code execution or persistence. Because the Azure activity log only exposes the extension instance name (not publisher/type), the rule uses a type-agnostic approach: it derives the host and extension instance from azure.resource.name and alerts on the first time a given (host, extension name) pair appears within the window. This surfaces novel extension deployments while suppressing extensions that a host frequently deploys. The Elastic SQL-like query parses actions that write VM extensions, computes host and extension name from the resource path, aggregates by host/extension, and triggers only when a (host, extension) pair is seen once in the window and within a short recency (10 minutes). The rule includes alert suppression by host resource name and provides a focused investigation path and remediation guidance.