Windows Network Connections to azurefd.net Excluding Common Browsers and Known Front Door Hostnames

Flags Windows connections to azurefd.net that aren’t from common browsers/search or known benign Azure Front Door domains.

FreeUnreviewedSigmamediumv1

windows-network-connections-to-azurefd-net-excluding-common-browsers-and-known-f-8cb4d14e

title: Windows Network Connections to azurefd.net Excluding Common Browsers and Known Front Door Hostnames
id: 244e7940-7443-4f78-84eb-cb6626bf3539
status: test
description: This rule flags Windows network connections whose destination hostname contains azurefd.net while excluding traffic from common web browsers and Windows search service, and excluding several known benign Azure Front Door endpoints. Because Azure Front Door can be abused as a proxy or redirector, unexpected use outside an established baseline may indicate cloud-based command-and-control activity. The detection relies on network connection telemetry (destination hostname) and the process image initiating the connection, with allowlisting for specific Azure Front Door hostnames.
references:
  - https://lots-project.com/site/2a2e617a75726566642e6e6574
  - https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
  - https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_susp_azurefd_connection.yml
author: Isaac Dunham, Huntrule Team
date: 2024-11-07
tags:
  - attack.command-and-control
  - attack.t1102.002
  - attack.t1090.004
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains: azurefd.net
  filter_main_web_browsers:
    Image|endswith:
      - brave.exe
      - chrome.exe
      - chromium.exe
      - firefox.exe
      - msedge.exe
      - msedgewebview2.exe
      - opera.exe
      - vivaldi.exe
  filter_main_common_talkers:
    Image|endswith: searchapp.exe
  filter_main_known_benign_domains:
    DestinationHostname|contains:
      - afdxtest.z01.azurefd.net
      - fp-afd.azurefd.net
      - fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net
      - roxy.azurefd.net
      - powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net
      - storage-explorer-publishing-feapcgfgbzc2cjek.b01.azurefd.net
      - graph.azurefd.net
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Results are not inherently suspicious, but should be investigated during threat hunting for potential cloud C2.
  - Organization-specific Azure Front Door endpoints
level: medium
license: DRL-1.1
related:
  - id: 8cb4d14e-776e-43c2-8fb9-91e7fcea32b4
    type: derived

What it detects

This rule flags Windows network connections whose destination hostname contains azurefd.net while excluding traffic from common web browsers and Windows search service, and excluding several known benign Azure Front Door endpoints. Because Azure Front Door can be abused as a proxy or redirector, unexpected use outside an established baseline may indicate cloud-based command-and-control activity. The detection relies on network connection telemetry (destination hostname) and the process image initiating the connection, with allowlisting for specific Azure Front Door hostnames.

Known false positives

Results are not inherently suspicious, but should be investigated during threat hunting for potential cloud C2.
Organization-specific Azure Front Door endpoints

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.