huntrule

Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

Flags HybridConnectionManager-initiated DNS queries to servicebus.windows.net on Windows.

FreeReviewedSigma · High · v2
Product
windows
Category
dns_query
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published
2021-04-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies DNS queries on Windows where the queried name contains servicebus.windows.net and the process image contains HybridConnectionManager. Attackers could blend in by using legitimate components that access Azure Service Bus over DNS to maintain or persist connectivity. It relies on telemetry that includes DNS query names and the originating process image.

Reporting behind it

Related detections8 linkedT1554 — drag to rearrange
Malicious Backdoored liblzma XZ Utils Library File via file_event
Suspicious Root Filesystem Remount as Writable on Appliance via Mount (via process_creation)
Malicious Backdoored liblzma Loaded by sshd (CVE-2024-3094)
Windows TanStack Supply-Chain File Creation Indicators via router_init.js and router_runtime.js
Linux setcap sets cap_setgid on binaries (Setgid capability assignment)
Linux setcap sets cap_setuid on a binary via setcap utility
Windows Security Event 4697: HybridConnectionManager Service Installation
Windows Hybrid Connection Manager Service Activity (Event IDs 40300-40302)
Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)
Pivot detection · T1554 · 8 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.