Windows Network Connections to azurefd.net Excluding Common Browsers and Known Front Door Hostnames
Flags Windows connections to azurefd.net that aren’t from common browsers/search or known benign Azure Front Door domains.
- Product
- windows
- Category
- network_connection
- Author
- Isaac Dunham (SigmaHQ), DRL 1.1
- Published
- 2024-11-07
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows network connections whose destination hostname contains azurefd.net while excluding traffic from common web browsers and Windows search service, and excluding several known benign Azure Front Door endpoints. Because Azure Front Door can be abused as a proxy or redirector, unexpected use outside an established baseline may indicate cloud-based command-and-control activity. The detection relies on network connection telemetry (destination hostname) and the process image initiating the connection, with allowlisting for specific Azure Front Door hostnames.
Reporting behind it
- lots-project.comhttps://lots-project.com/site/2a2e617a75726566642e6e6574
- medium.comhttps://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
- fortalicesolutions.comhttps://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_susp_azurefd_connection.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Network Connections to azurefd.net Excluding Common Browsers and Known Front Door Hostnames
id: 244e7940-7443-4f78-84eb-cb6626bf3539
status: test
description: This rule flags Windows network connections whose destination hostname contains azurefd.net while excluding traffic from common web browsers and Windows search service, and excluding several known benign Azure Front Door endpoints. Because Azure Front Door can be abused as a proxy or redirector, unexpected use outside an established baseline may indicate cloud-based command-and-control activity. The detection relies on network connection telemetry (destination hostname) and the process image initiating the connection, with allowlisting for specific Azure Front Door hostnames.
references:
- https://lots-project.com/site/2a2e617a75726566642e6e6574
- https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
- https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_susp_azurefd_connection.yml
author: Isaac Dunham, Huntrule Team
date: 2024-11-07
tags:
- attack.command-and-control
- attack.t1102.002
- attack.t1090.004
- detection.threat-hunting
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname|contains: azurefd.net
filter_main_web_browsers:
Image|endswith:
- brave.exe
- chrome.exe
- chromium.exe
- firefox.exe
- msedge.exe
- msedgewebview2.exe
- opera.exe
- vivaldi.exe
filter_main_common_talkers:
Image|endswith: searchapp.exe
filter_main_known_benign_domains:
DestinationHostname|contains:
- afdxtest.z01.azurefd.net
- fp-afd.azurefd.net
- fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net
- roxy.azurefd.net
- powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net
- storage-explorer-publishing-feapcgfgbzc2cjek.b01.azurefd.net
- graph.azurefd.net
condition: selection and not 1 of filter_main_*
falsepositives:
- Results are not inherently suspicious, but should be investigated during threat hunting for potential cloud C2.
- Organization-specific Azure Front Door endpoints
level: medium
license: DRL-1.1
related:
- id: 8cb4d14e-776e-43c2-8fb9-91e7fcea32b4
type: derived