Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

HybridConnectionManager Service Running

Rule to detect the Hybrid Connection Manager service running on an endpoint.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)Created Mon Apr 12Updated Mon Aug 05b55d23e5-6821-44ff-8a6e-67218891e49fwindows
Log Source
Windowsmicrosoft-servicebus-client
ProductWindows← raw: windows
Servicemicrosoft-servicebus-client← raw: microsoft-servicebus-client
Detection Logic
Detection Logic2 selectors
detection:
    selection:
        EventID:
            - 40300
            - 40301
            - 40302
    keywords:
        - 'HybridConnection'
        - 'sb://'
        - 'servicebus.windows.net'
        - 'HybridConnectionManage'
    condition: selection and keywords
False Positives

Legitimate use of Hybrid Connection Manager via Azure function apps.

References
1
Resolving title…
twitter.com
MITRE ATT&CK
Rule Metadata
Rule ID
b55d23e5-6821-44ff-8a6e-67218891e49f
Status
test
Level
high
Type
Detection
Created
Mon Apr 12
Modified
Mon Aug 05
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Path
rules/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml
Raw Tags
attack.persistenceattack.t1554
View on GitHub