Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a live sigma-cli backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,707
Ready to search
Backends
17
Live from sigconverter.io
CLI Versions
10
Newest: 2.0.2
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
Potentially Suspicious Azure Front Door Connection
Target Profile
Splunk
Splunk SPL & tstats data model queries
Format Mode
Default
Plain SPL queries
Conversion Output
Potentially Suspicious Azure Front Door Connection
Using Splunk · Default · sigma-cli 2.0.2
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion2.0.2
title: Potentially Suspicious Azure Front Door Connection
id: 8cb4d14e-776e-43c2-8fb9-91e7fcea32b4
status: test
description: |
Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2)
that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)
references:
- https://lots-project.com/site/2a2e617a75726566642e6e6574
- https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
- https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
author: Isaac Dunham
date: 2024-11-07
tags:
- attack.command-and-control
- attack.t1102.002
- attack.t1090.004
- detection.threat-hunting
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname|contains: 'azurefd.net'
filter_main_web_browsers:
Image|endswith:
- 'brave.exe'
- 'chrome.exe'
- 'chromium.exe'
- 'firefox.exe'
- 'msedge.exe'
- 'msedgewebview2.exe'
- 'opera.exe'
- 'vivaldi.exe'
filter_main_common_talkers:
Image|endswith: 'searchapp.exe' # Windows search service uses signifcant amount of Azure FD
filter_main_known_benign_domains:
DestinationHostname|contains:
- 'afdxtest.z01.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
- 'fp-afd.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
- 'fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
- 'roxy.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
- 'powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net' # Used by VS Code; Cisco Umbrella top 1m
- 'storage-explorer-publishing-feapcgfgbzc2cjek.b01.azurefd.net' # Used by Azure Storage Explorer; Cisco Umbrella top 1m
- 'graph.azurefd.net' # MS Graph; Cisco Umbrella top 1m
condition: selection and not 1 of filter_main_*
falsepositives:
- Results are not inherently suspicious, but should be investigated during threat hunting for potential cloud C2.
- Organization-specific Azure Front Door endpoints
level: medium
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules-threat-hunting/windows/network_connection/net_connection_win_susp_azurefd_connection.yml