huntrule

Windows Hybrid Connection Manager Service Activity (Event IDs 40300-40302)

Flags Windows Hybrid Connection Manager-related events mentioning sb:// and servicebus.windows.net.

FreeReviewedSigma · High · v2
Product
windows
Service
microsoft-servicebus-client
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published
2021-04-12
Updated
2026-07-31
AnalysisDetection
title: Windows Hybrid Connection Manager Service Activity (Event IDs 40300-40302)
id: f376387f-7696-4c97-a0d3-6e3657fd2fc6
status: test
description: This rule identifies Windows activity associated with Hybrid Connection Manager by matching specific service-related Event IDs (40300, 40301, 40302) and keyword strings tied to Hybrid Connection configuration. Attackers may use this mechanism to enable persistent connectivity through Azure Relay/Service Bus style endpoints, making servicebus-related indicators valuable for early detection. It relies on Windows service event telemetry and correlates the events with text artifacts such as 'HybridConnection', 'sb://', and 'servicebus.windows.net'.
references:
  - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2021-04-12
modified: 2024-08-05
tags:
  - attack.persistence
  - attack.t1554
logsource:
  product: windows
  service: microsoft-servicebus-client
detection:
  selection:
    EventID:
      - 40300
      - 40301
      - 40302
  keywords:
    - HybridConnection
    - sb://
    - servicebus.windows.net
    - HybridConnectionManage
  condition: selection and keywords
falsepositives:
  - Legitimate use of Hybrid Connection Manager via Azure function apps.
level: high
license: DRL-1.1
related:
  - id: b55d23e5-6821-44ff-8a6e-67218891e49f
    type: derived