Windows DNS Queries Triggered by Azure HybridConnectionManager to servicebus.windows.net

title: Windows DNS Queries Triggered by Azure HybridConnectionManager to servicebus.windows.net
id: 552a8df3-e919-4bb8-a474-9c9e8a6562f9
status: test
description: Identifies Windows systems where DNS queries contain servicebus.windows.net and the querying process image contains HybridConnectionManager. Attackers can misuse or impersonate legitimate cloud connectivity components to reach Azure Service Bus endpoints for command-and-control or persistence. This detection relies on DNS query telemetry that includes the queried name and the responsible process image.
references:
  - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2021-04-12
modified: 2023-01-16
tags:
  - attack.persistence
  - attack.t1554
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|contains: servicebus.windows.net
    Image|contains: HybridConnectionManager
  condition: selection
falsepositives:
  - Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service
level: high
license: DRL-1.1
related:
  - id: 7bd3902d-8b8b-4dd4-838a-c6862d40150d
    type: derived