Windows Non-Browser Process Connecting to azurewebsites.net

title: Windows Non-Browser Process Connecting to azurewebsites.net
id: c130ec7f-267f-459d-a0e8-f3fa601853df
related:
  - id: e043f529-8514-4205-8ab0-7f7d2927b400
    type: derived
  - id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83
    type: derived
status: test
description: This rule flags initiated outbound network connections from a Windows host to a destination hostname that ends with azurewebsites.net, provided the initiating process is not identified as a common browser or related browser binaries. Attackers may use cloud web hosting domains to stage payloads, support command-and-control, or exfiltrate data, making unexpected non-browser connections to this domain noteworthy. It relies on network connection events with an Initiated=true indicator and a destination hostname match, along with process image path telemetry to exclude common browsers and select legitimate tooling.
references:
  - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/
  - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_azurewebsites.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-24
modified: 2024-07-16
tags:
  - attack.command-and-control
  - attack.t1102
  - attack.t1102.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: azurewebsites.net
  filter_main_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_main_chrome_appdata:
    Image|startswith: C:\Users\
    Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe
  filter_main_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_main_firefox_appdata:
    Image|startswith: C:\Users\
    Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe
  filter_main_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_main_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_main_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_main_safari:
    Image|contains:
      - C:\Program Files (x86)\Safari\
      - C:\Program Files\Safari\
    Image|endswith: \safari.exe
  filter_main_defender:
    Image|contains:
      - C:\Program Files\Windows Defender Advanced Threat Protection\
      - C:\Program Files\Windows Defender\
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
    Image|endswith:
      - \MsMpEng.exe
      - \MsSense.exe
  filter_main_prtg:
    Image|endswith:
      - C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe
      - C:\Program Files\PRTG Network Monitor\PRTG Probe.exe
  filter_main_brave:
    Image|startswith: C:\Program Files\BraveSoftware\
    Image|endswith: \brave.exe
  filter_main_maxthon:
    Image|contains: \AppData\Local\Maxthon\
    Image|endswith: \maxthon.exe
  filter_main_opera:
    Image|contains: \AppData\Local\Programs\Opera\
    Image|endswith: \opera.exe
  filter_main_seamonkey:
    Image|startswith:
      - C:\Program Files\SeaMonkey\
      - C:\Program Files (x86)\SeaMonkey\
    Image|endswith: \seamonkey.exe
  filter_main_vivaldi:
    Image|contains: \AppData\Local\Vivaldi\
    Image|endswith: \vivaldi.exe
  filter_main_whale:
    Image|startswith:
      - C:\Program Files\Naver\Naver Whale\
      - C:\Program Files (x86)\Naver\Naver Whale\
    Image|endswith: \whale.exe
  filter_main_whaterfox:
    Image|startswith:
      - C:\Program Files\Waterfox\
      - C:\Program Files (x86)\Waterfox\
    Image|endswith: \Waterfox.exe
  filter_main_slimbrowser:
    Image|startswith:
      - C:\Program Files\SlimBrowser\
      - C:\Program Files (x86)\SlimBrowser\
    Image|endswith: \slimbrowser.exe
  filter_main_flock:
    Image|contains: \AppData\Local\Flock\
    Image|endswith: \Flock.exe
  filter_main_phoebe:
    Image|contains: \AppData\Local\Phoebe\
    Image|endswith: \Phoebe.exe
  filter_main_falkon:
    Image|startswith:
      - C:\Program Files\Falkon\
      - C:\Program Files (x86)\Falkon\
    Image|endswith: \falkon.exe
  filter_main_qtweb:
    Image|startswith:
      - C:\Program Files (x86)\QtWeb\
      - C:\Program Files\QtWeb\
    Image|endswith: \QtWeb.exe
  filter_main_avant:
    Image|startswith:
      - C:\Program Files (x86)\Avant Browser\
      - C:\Program Files\Avant Browser\
    Image|endswith: \avant.exe
  filter_main_discord:
    Image|contains: \AppData\Local\Discord\
    Image|endswith: \Discord.exe
  filter_main_null:
    Image: null
  filter_main_empty:
    Image: ""
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1