Windows Network Connections to azurefd.net Excluding Common Browsers and Known Front Door Hostnames

title: Windows Network Connections to azurefd.net Excluding Common Browsers and Known Front Door Hostnames
id: 244e7940-7443-4f78-84eb-cb6626bf3539
status: test
description: This rule flags Windows network connections whose destination hostname contains azurefd.net while excluding traffic from common web browsers and Windows search service, and excluding several known benign Azure Front Door endpoints. Because Azure Front Door can be abused as a proxy or redirector, unexpected use outside an established baseline may indicate cloud-based command-and-control activity. The detection relies on network connection telemetry (destination hostname) and the process image initiating the connection, with allowlisting for specific Azure Front Door hostnames.
references:
  - https://lots-project.com/site/2a2e617a75726566642e6e6574
  - https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
  - https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_susp_azurefd_connection.yml
author: Isaac Dunham, Huntrule Team
date: 2024-11-07
tags:
  - attack.command-and-control
  - attack.t1102.002
  - attack.t1090.004
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains: azurefd.net
  filter_main_web_browsers:
    Image|endswith:
      - brave.exe
      - chrome.exe
      - chromium.exe
      - firefox.exe
      - msedge.exe
      - msedgewebview2.exe
      - opera.exe
      - vivaldi.exe
  filter_main_common_talkers:
    Image|endswith: searchapp.exe
  filter_main_known_benign_domains:
    DestinationHostname|contains:
      - afdxtest.z01.azurefd.net
      - fp-afd.azurefd.net
      - fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net
      - roxy.azurefd.net
      - powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net
      - storage-explorer-publishing-feapcgfgbzc2cjek.b01.azurefd.net
      - graph.azurefd.net
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Results are not inherently suspicious, but should be investigated during threat hunting for potential cloud C2.
  - Organization-specific Azure Front Door endpoints
level: medium
license: DRL-1.1
related:
  - id: 8cb4d14e-776e-43c2-8fb9-91e7fcea32b4
    type: derived