HybridConnectionManager Service Running

Title: HybridConnectionManager Service Running
Status: test
Description:Rule to detect the Hybrid Connection Manager service running on an endpoint.
References:
  -https://twitter.com/Cyb3rWard0g/status/1381642789369286662
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2021-04-12
modified:2024-08-05
Tags:

• -'attack.persistence'
• -'attack.t1554'

Logsource:

• product: windows
• service: microsoft-servicebus-client

Detection:
  selection:
    EventID:
      -'40300'
      -'40301'
      -'40302'

  keywords:
    - 'HybridConnection'
    - 'sb://'
    - 'servicebus.windows.net'
    - 'HybridConnectionManage'
  condition:selection and keywords
Falsepositives:
  -Legitimate use of Hybrid Connection Manager via Azure function apps.
Level: high