Detection rules › Sigma

DNS HybridConnectionManager Service Bus

Severity
high
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source
upstream

Detects Azure Hybrid Connection Manager services querying the Azure service bus service

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1554 Compromise Host Software Binary

Event coverage

ProviderEvent IDTitle
Sysmon22DNSEvent (DNS query)

Stages and Predicates

Stage 1: selection

Image|contains: HybridConnectionManager
QueryName|contains: servicebus.windows.net

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imagematch
  • HybridConnectionManager
QueryNamematch
  • servicebus.windows.net