Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

ATT&CK techniques

Persistence

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1554Compromise Host Software Binary
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies DNS queries on Windows where the queried name contains servicebus.windows.net and the process image contains HybridConnectionManager. Attackers could blend in by using legitimate components that access Azure Service Bus over DNS to maintain or persist connectivity. It relies on telemetry that includes DNS query names and the originating process image.

Reporting behind it

Related detections8 linkedT1554 — drag to rearrange

Malicious Backdoored liblzma XZ Utils Library File via file_event

Suspicious Root Filesystem Remount as Writable on Appliance via Mount (via process_creation)

Malicious Backdoored liblzma Loaded by sshd (CVE-2024-3094)

Windows TanStack Supply-Chain File Creation Indicators via router_init.js and router_runtime.js

Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Linux setcap sets cap_setuid on a binary via setcap utility

Windows Security Event 4697: HybridConnectionManager Service Installation

Windows Hybrid Connection Manager Service Activity (Event IDs 40300-40302)

Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

Pivot detection · T1554 · 8 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-queries-triggered-by-azure-hybridconnectionmanager-to-servicebus-win-7bd3902d

title: Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)
id: 552a8df3-e919-4bb8-a474-9c9e8a6562f9
status: test
description: This rule identifies DNS queries on Windows where the queried name contains servicebus.windows.net and the process image contains HybridConnectionManager. Attackers could blend in by using legitimate components that access Azure Service Bus over DNS to maintain or persist connectivity. It relies on telemetry that includes DNS query names and the originating process image.
references:
  - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2021-04-12
modified: 2023-01-16
tags:
  - attack.persistence
  - attack.t1554
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|contains: servicebus.windows.net
    Image|contains: HybridConnectionManager
  condition: selection
falsepositives:
  - Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service
level: high
license: DRL-1.1
related:
  - id: 7bd3902d-8b8b-4dd4-838a-c6862d40150d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL