Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

DNS HybridConnectionManager Service Bus

Detects Azure Hybrid Connection Manager services querying the Azure service bus service

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)Created Mon Apr 12Updated Mon Jan 167bd3902d-8b8b-4dd4-838a-c6862d40150dwindows
Log Source
WindowsDNS Query
ProductWindows← raw: windows
CategoryDNS Query← raw: dns_query

DNS lookup events generated by endpoint monitoring tools.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        QueryName|contains: 'servicebus.windows.net'
        Image|contains: 'HybridConnectionManager'
    condition: selection
False Positives

Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service

References
1
Resolving title…
twitter.com
MITRE ATT&CK
Rule Metadata
Rule ID
7bd3902d-8b8b-4dd4-838a-c6862d40150d
Status
test
Level
high
Type
Detection
Created
Mon Apr 12
Modified
Mon Jan 16
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Path
rules/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml
Raw Tags
attack.persistenceattack.t1554
View on GitHub