Title:DNS HybridConnectionManager Service Bus Status:test Description:Detects Azure Hybrid Connection Manager services querying the Azure service bus service References: -https://twitter.com/Cyb3rWard0g/status/1381642789369286662 Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) Date: 2021-04-12 modified:2023-01-16 Tags:
-'attack.persistence'
-'attack.t1554'
Logsource:
product: windows
category: dns_query
Detection: selection: QueryName|contains:
'servicebus.windows.net' Image|contains:
'HybridConnectionManager' condition:selection Falsepositives:
-Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service Level:high
