Windows Service Installation: HybridConnectionManager (Event ID 4697)

Alerts on HybridConnectionManager service installation on Windows via Security Event ID 4697.

FreeUnreviewedSigmahighv1

windows-service-installation-hybridconnectionmanager-event-id-4697-0ee4d8a5

title: "Windows Service Installation: HybridConnectionManager (Event ID 4697)"
id: 2f2dc11a-2e43-47e4-b90e-c13747890052
status: test
description: This rule flags Windows Service Control Manager events where a service named HybridConnectionManager is installed, matched by Event ID 4697 and the service name/file containing HybridConnectionManager. Attackers may install services to establish persistence or execute attacker-controlled functionality under the Windows service framework. The detection relies on Windows Security auditing telemetry for service installation events (4697) including service name and service file name.
references:
  - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2021-04-12
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.t1554
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceName: HybridConnectionManager
    ServiceFileName|contains: HybridConnectionManager
  condition: selection
falsepositives:
  - Legitimate use of Hybrid Connection Manager via Azure function apps.
level: high
license: DRL-1.1
related:
  - id: 0ee4d8a5-4e67-4faf-acfa-62a78457d1f2
    type: derived

What it detects

This rule flags Windows Service Control Manager events where a service named HybridConnectionManager is installed, matched by Event ID 4697 and the service name/file containing HybridConnectionManager. Attackers may install services to establish persistence or execute attacker-controlled functionality under the Windows service framework. The detection relies on Windows Security auditing telemetry for service installation events (4697) including service name and service file name.

Known false positives

Legitimate use of Hybrid Connection Manager via Azure function apps.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.