Windows Hybrid Connection Manager service events with Service Bus endpoints

Flags Windows Hybrid Connection Manager-related events mentioning sb:// and servicebus.windows.net.

FreeUnreviewedSigmahighv1

windows-hybrid-connection-manager-service-events-with-service-bus-endpoints-b55d23e5

title: Windows Hybrid Connection Manager service events with Service Bus endpoints
id: f376387f-7696-4c97-a0d3-6e3657fd2fc6
status: test
description: This rule identifies Windows service activity consistent with Hybrid Connection Manager, based on specific service-related EventIDs combined with keywords for HybridConnection and Service Bus endpoint strings (sb:// and servicebus.windows.net). Attackers can abuse Hybrid Connections to enable stealthy connectivity and persistence by tunneling traffic through Azure Service Bus infrastructure. Detection relies on Windows event telemetry carrying the specified EventIDs and matching the endpoint-related keyword patterns in the event fields.
references:
  - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2021-04-12
modified: 2024-08-05
tags:
  - attack.persistence
  - attack.t1554
logsource:
  product: windows
  service: microsoft-servicebus-client
detection:
  selection:
    EventID:
      - 40300
      - 40301
      - 40302
  keywords:
    - HybridConnection
    - sb://
    - servicebus.windows.net
    - HybridConnectionManage
  condition: selection and keywords
falsepositives:
  - Legitimate use of Hybrid Connection Manager via Azure function apps.
level: high
license: DRL-1.1
related:
  - id: b55d23e5-6821-44ff-8a6e-67218891e49f
    type: derived

What it detects

This rule identifies Windows service activity consistent with Hybrid Connection Manager, based on specific service-related EventIDs combined with keywords for HybridConnection and Service Bus endpoint strings (sb:// and servicebus.windows.net). Attackers can abuse Hybrid Connections to enable stealthy connectivity and persistence by tunneling traffic through Azure Service Bus infrastructure. Detection relies on Windows event telemetry carrying the specified EventIDs and matching the endpoint-related keyword patterns in the event fields.

Known false positives

Legitimate use of Hybrid Connection Manager via Azure function apps.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.