Yeah, if they really wanted they could have some spyware running in each VM to detect blacklisted processes. However, as a customer i would find this a bit invasive (even if i don't intend to run any of the blacklisted programs). So i am not really convinced that their detection works like that. Azure could also do some checks along the lines of "IF the cpu-load is 100% AND there are tcp-connections to known mining-pools THEN assume that the VM is used for mining". For this kind of detection no internal access to the VM would be necessary (and changing the miner-binary would not help at all).

Do you have experience with changing the binary in such a case? Did it actually help?