HybridConnectionManager Service Installation - Registry

Title: HybridConnectionManager Service Installation - Registry
Status: test
Description:Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.
References:
  -https://twitter.com/Cyb3rWard0g/status/1381642789369286662
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2021-04-12
modified:2022-11-27
Tags:

• -'attack.resource-development'
• -'attack.t1608'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection1:
    TargetObject|contains: '\Services\HybridConnectionManager'
  selection2:
    EventType: 'SetValue'
    Details|contains: 'Microsoft.HybridConnectionManager.Listener.exe'
  condition:selection1 or selection2
Falsepositives:
  -Unknown
Level: high