Network Connection Initiated To AzureWebsites.NET By Non-Browser Process

Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1102` Web Service, `T1102.001` Web Service: Dead Drop Resolver

Event coverage

Provider	Event ID	Title
Sysmon	3	Network connection

Stages and Predicates

Stage 1: `selection`

DestinationHostname|endswith: azurewebsites.net
Initiated: true

Stage 2: `not 1 of filter_main_*`

or:
or:
Image|endswith: '\MsMpEng.exe'
Image|endswith: '\MsSense.exe'
or:
Image|contains: 'C:\Program Files\Windows Defender Advanced Threat Protection\'
Image|contains: 'C:\Program Files\Windows Defender\'
Image|contains: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
or:
Image|endswith: '\msedge.exe'
Image|endswith: '\msedgewebview2.exe'
or:
Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeCore\'
Image|startswith: 'C:\Program Files\Microsoft\EdgeCore\'
or:
Image|contains: 'C:\Program Files (x86)\Safari\'
Image|contains: 'C:\Program Files\Safari\'
Image|endswith: '\safari.exe'
or:
Image|startswith: 'C:\Program Files (x86)\Avant Browser\'
Image|startswith: 'C:\Program Files\Avant Browser\'
Image|endswith: '\avant.exe'
or:
Image|startswith: 'C:\Program Files (x86)\Falkon\'
Image|startswith: 'C:\Program Files\Falkon\'
Image|endswith: '\falkon.exe'
or:
Image|startswith: 'C:\Program Files (x86)\Naver\Naver Whale\'
Image|startswith: 'C:\Program Files\Naver\Naver Whale\'
Image|endswith: '\whale.exe'
or:
Image|startswith: 'C:\Program Files (x86)\QtWeb\'
Image|startswith: 'C:\Program Files\QtWeb\'
Image|endswith: '\QtWeb.exe'
or:
Image|startswith: 'C:\Program Files (x86)\SeaMonkey\'
Image|startswith: 'C:\Program Files\SeaMonkey\'
Image|endswith: '\seamonkey.exe'
or:
Image|startswith: 'C:\Program Files (x86)\SlimBrowser\'
Image|startswith: 'C:\Program Files\SlimBrowser\'
Image|endswith: '\slimbrowser.exe'
or:
Image|startswith: 'C:\Program Files (x86)\Waterfox\'
Image|startswith: 'C:\Program Files\Waterfox\'
Image|endswith: '\Waterfox.exe'
Image|endswith: '\AppData\Local\Google\Chrome\Application\chrome.exe'
Image|startswith: 'C:\Users\'
Image|endswith: '\AppData\Local\Mozilla Firefox\firefox.exe'
Image|startswith: 'C:\Users\'
Image|endswith: '\Discord.exe'
Image|contains: '\AppData\Local\Discord\'
Image|endswith: '\Flock.exe'
Image|contains: '\AppData\Local\Flock\'
Image|endswith: '\Phoebe.exe'
Image|contains: '\AppData\Local\Phoebe\'
Image|endswith: '\brave.exe'
Image|startswith: 'C:\Program Files\BraveSoftware\'
Image|endswith: '\maxthon.exe'
Image|contains: '\AppData\Local\Maxthon\'
Image|endswith: '\opera.exe'
Image|contains: '\AppData\Local\Programs\Opera\'
Image|endswith: '\vivaldi.exe'
Image|contains: '\AppData\Local\Vivaldi\'
Image|endswith: 'C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe'
Image|endswith: 'C:\Program Files\PRTG Network Monitor\PRTG Probe.exe'
Image|endswith: '\WindowsApps\MicrosoftEdge.exe'
Image: ''
Image: 'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe'
Image: 'C:\Program Files (x86)\Internet Explorer\iexplore.exe'
Image: 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
Image: 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'
Image: 'C:\Program Files\Google\Chrome\Application\chrome.exe'
Image: 'C:\Program Files\Internet Explorer\iexplore.exe'
Image: 'C:\Program Files\Microsoft\Edge\Application\msedge.exe'
Image: 'C:\Program Files\Mozilla Firefox\firefox.exe'
Image: null
Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeWebView\Application\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`DestinationHostname`	ends_with	`azurewebsites.net`
`Image`	ends_with	`C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe` corpus 2 (sigma 2) `C:\Program Files\PRTG Network Monitor\PRTG Probe.exe` corpus 2 (sigma 2) `\AppData\Local\Google\Chrome\Application\chrome.exe` corpus 2 (sigma 2) `\AppData\Local\Mozilla Firefox\firefox.exe` corpus 2 (sigma 2) `\Discord.exe` corpus 3 (sigma 3) `\Flock.exe` corpus 4 (sigma 4) `\MsMpEng.exe` corpus 13 (sigma 13) `\MsSense.exe` corpus 5 (sigma 5) `\Phoebe.exe` corpus 4 (sigma 4) `\QtWeb.exe` corpus 2 (sigma 2) `\Waterfox.exe` corpus 4 (sigma 4) `\WindowsApps\MicrosoftEdge.exe` corpus 12 (sigma 12) `\avant.exe` corpus 4 (sigma 4) `\brave.exe` corpus 20 (sigma 20) `\falkon.exe` corpus 4 (sigma 4) `\maxthon.exe` corpus 13 (sigma 13) `\msedge.exe` corpus 22 (sigma 22) `\msedgewebview2.exe` corpus 15 (sigma 15) `\opera.exe` corpus 21 (sigma 21) `\safari.exe` corpus 12 (sigma 12) `\seamonkey.exe` corpus 13 (sigma 13) `\slimbrowser.exe` corpus 4 (sigma 4) `\vivaldi.exe` corpus 19 (sigma 19) `\whale.exe` corpus 12 (sigma 12)
`Image`	eq	`C:\Program Files (x86)\Google\Chrome\Application\chrome.exe` corpus 11 (sigma 11) `C:\Program Files (x86)\Internet Explorer\iexplore.exe` corpus 10 (sigma 10) `C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe` corpus 11 (sigma 11) `C:\Program Files (x86)\Mozilla Firefox\firefox.exe` corpus 11 (sigma 11) `C:\Program Files\Google\Chrome\Application\chrome.exe` corpus 12 (sigma 12) `C:\Program Files\Internet Explorer\iexplore.exe` corpus 11 (sigma 11) `C:\Program Files\Microsoft\Edge\Application\msedge.exe` corpus 11 (sigma 11) `C:\Program Files\Mozilla Firefox\firefox.exe` corpus 12 (sigma 12)
`Image`	match	`C:\Program Files (x86)\Safari\` corpus 2 (sigma 2) `C:\Program Files\Safari\` corpus 2 (sigma 2) `C:\Program Files\Windows Defender Advanced Threat Protection\` corpus 2 (sigma 2) `C:\Program Files\Windows Defender\` corpus 2 (sigma 2) `C:\ProgramData\Microsoft\Windows Defender\Platform\` corpus 2 (sigma 2) `\AppData\Local\Discord\` corpus 2 (sigma 2) `\AppData\Local\Flock\` corpus 4 (sigma 4) `\AppData\Local\Maxthon\` corpus 4 (sigma 4) `\AppData\Local\Phoebe\` corpus 4 (sigma 4) `\AppData\Local\Programs\Opera\` corpus 5 (sigma 5) `\AppData\Local\Vivaldi\` corpus 4 (sigma 4)
`Image`	starts_with	`C:\Program Files (x86)\Avant Browser\` corpus 4 (sigma 4) `C:\Program Files (x86)\Falkon\` corpus 4 (sigma 4) `C:\Program Files (x86)\Microsoft\EdgeCore\` corpus 11 (sigma 11) `C:\Program Files (x86)\Microsoft\EdgeWebView\Application\` corpus 10 (sigma 10) `C:\Program Files (x86)\Naver\Naver Whale\` corpus 4 (sigma 4) `C:\Program Files (x86)\QtWeb\` corpus 2 (sigma 2) `C:\Program Files (x86)\SeaMonkey\` corpus 4 (sigma 4) `C:\Program Files (x86)\SlimBrowser\` corpus 4 (sigma 4) `C:\Program Files (x86)\Waterfox\` corpus 4 (sigma 4) `C:\Program Files\Avant Browser\` corpus 4 (sigma 4) `C:\Program Files\BraveSoftware\` corpus 4 (sigma 4) `C:\Program Files\Falkon\` corpus 4 (sigma 4) `C:\Program Files\Microsoft\EdgeCore\` corpus 11 (sigma 11) `C:\Program Files\Naver\Naver Whale\` corpus 4 (sigma 4) `C:\Program Files\QtWeb\` corpus 2 (sigma 2) `C:\Program Files\SeaMonkey\` corpus 4 (sigma 4) `C:\Program Files\SlimBrowser\` corpus 4 (sigma 4) `C:\Program Files\Waterfox\` corpus 4 (sigma 4) `C:\Users\` corpus 7 (sigma 7)
`Initiated`	eq	`true` corpus 40 (sigma 40)