Windows DNS Queries to azurewebsites.net From Non-Browser Processes

title: Windows DNS Queries to azurewebsites.net From Non-Browser Processes
id: bad03f22-59fc-4952-8a31-0f5013b62cc9
related:
  - id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83
    type: derived
  - id: e043f529-8514-4205-8ab0-7f7d2927b400
    type: derived
status: test
description: This rule flags DNS queries whose QueryName ends with azurewebsites.net when they originate from a process other than several common web browsers and Defender components. Querying this domain from non-browser software is notable because it may indicate automated infrastructure access such as command-and-control or data exfiltration pathways. The detection relies on Windows DNS query telemetry including the queried domain name and the querying process image path, with browser processes excluded to reduce noise.
references:
  - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/
  - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_domain_azurewebsites.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-24
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|endswith: azurewebsites.net
  filter_optional_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_optional_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_optional_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_optional_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_optional_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_optional_safari:
    Image|endswith: \safari.exe
  filter_optional_defender:
    Image|endswith:
      - \MsMpEng.exe
      - \MsSense.exe
  filter_optional_brave:
    Image|endswith: \brave.exe
    Image|startswith: C:\Program Files\BraveSoftware\
  filter_optional_maxthon:
    Image|contains: \AppData\Local\Maxthon\
    Image|endswith: \maxthon.exe
  filter_optional_opera:
    Image|contains: \AppData\Local\Programs\Opera\
    Image|endswith: \opera.exe
  filter_optional_seamonkey:
    Image|startswith:
      - C:\Program Files\SeaMonkey\
      - C:\Program Files (x86)\SeaMonkey\
    Image|endswith: \seamonkey.exe
  filter_optional_vivaldi:
    Image|contains: \AppData\Local\Vivaldi\
    Image|endswith: \vivaldi.exe
  filter_optional_whale:
    Image|startswith:
      - C:\Program Files\Naver\Naver Whale\
      - C:\Program Files (x86)\Naver\Naver Whale\
    Image|endswith: \whale.exe
  filter_optional_tor:
    Image|contains: \Tor Browser\
  filter_optional_whaterfox:
    Image|startswith:
      - C:\Program Files\Waterfox\
      - C:\Program Files (x86)\Waterfox\
    Image|endswith: \Waterfox.exe
  filter_optional_midori:
    Image|contains: \AppData\Local\Programs\midori-ng\
    Image|endswith: \Midori Next Generation.exe
  filter_optional_slimbrowser:
    Image|startswith:
      - C:\Program Files\SlimBrowser\
      - C:\Program Files (x86)\SlimBrowser\
    Image|endswith: \slimbrowser.exe
  filter_optional_flock:
    Image|contains: \AppData\Local\Flock\
    Image|endswith: \Flock.exe
  filter_optional_phoebe:
    Image|contains: \AppData\Local\Phoebe\
    Image|endswith: \Phoebe.exe
  filter_optional_falkon:
    Image|startswith:
      - C:\Program Files\Falkon\
      - C:\Program Files (x86)\Falkon\
    Image|endswith: \falkon.exe
  filter_optional_avant:
    Image|startswith:
      - C:\Program Files (x86)\Avant Browser\
      - C:\Program Files\Avant Browser\
    Image|endswith: \avant.exe
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Likely with other browser software. Apply additional filters for any other browsers you might use.
level: medium
license: DRL-1.1