Detection rules › Sigma

HybridConnectionManager Service Installation - Registry

Severity
high
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source
upstream

Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

MITRE ATT&CK coverage

TacticTechniques
Resource DevelopmentT1608 Stage Capabilities

Event coverage

ProviderEvent IDTitle
Sysmon12RegistryEvent (Object create and delete)
Sysmon13RegistryEvent (Value Set)
Sysmon14RegistryEvent (Key and Value Rename)

Stages and Predicates

Stage 1: selection1

TargetObject|contains: '\Services\HybridConnectionManager'

Stage 2: selection2

Details|contains: 'Microsoft.HybridConnectionManager.Listener.exe'
EventType: SetValue

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • Microsoft.HybridConnectionManager.Listener.exe
EventTypeeq
  • SetValue corpus 3 (sigma 3)
TargetObjectmatch
  • \Services\HybridConnectionManager