{"id":"5c80b618-0dbb-46e6-acbb-03d90bcb6d83","title":"Network Connection Initiated To AzureWebsites.NET By Non-Browser Process","description":"Detects an initiated network connection by a non browser process on the system to \"azurewebsites.net\". The latter was often used by threat actors as a malware hosting and exfiltration site.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-06-24","modified":"2024-07-16","tags":["attack.command-and-control","attack.t1102","attack.t1102.001"],"technique_ids":["T1102","T1102.001"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/","https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/"],"source_path":"rules/windows/network_connection/net_connection_win_domain_azurewebsites.yml","source_sha256":"1488a4d084a4d12d8a91e18d9e6ade6b53d8be0639139de7ecf26933d3cd39ff","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_azurewebsites.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Network Connection Initiated To AzureWebsites.NET By Non-Browser Process\nid: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83\nrelated:\n    - id: e043f529-8514-4205-8ab0-7f7d2927b400\n      type: derived\nstatus: test\ndescription: |\n    Detects an initiated network connection by a non browser process on the system to \"azurewebsites.net\". The latter was often used by threat actors as a malware hosting and exfiltration site.\nreferences:\n    - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/\n    - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia\n    - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/\n    - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2024-06-24\nmodified: 2024-07-16\ntags:\n    - attack.command-and-control\n    - attack.t1102\n    - attack.t1102.001\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        Initiated: 'true'\n        DestinationHostname|endswith: 'azurewebsites.net'\n    # Note: Add/Remove browsers/applications that you don't use or those that have custom install locations\n    # Note: To avoid complex conditions the filters for some apps are generic by name only. A custom tuning is recommended for best results\n    filter_main_chrome:\n        Image:\n            - 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n            - 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n    filter_main_chrome_appdata:\n        Image|startswith: 'C:\\Users\\'\n        Image|endswith: '\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe'\n    filter_main_firefox:\n        Image:\n            - 'C:\\Program Files\\Mozilla Firefox\\firefox.exe'\n            - 'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'\n    filter_main_firefox_appdata:\n        Image|startswith: 'C:\\Users\\'\n        Image|endswith: '\\AppData\\Local\\Mozilla Firefox\\firefox.exe'\n    filter_main_ie:\n        Image:\n            - 'C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe'\n            - 'C:\\Program Files\\Internet Explorer\\iexplore.exe'\n    filter_main_edge_1:\n        - Image|startswith: 'C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\'\n        - Image|endswith: '\\WindowsApps\\MicrosoftEdge.exe'\n        - Image:\n              - 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n              - 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe'\n    filter_main_edge_2:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeCore\\'\n            - 'C:\\Program Files\\Microsoft\\EdgeCore\\'\n        Image|endswith:\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n    filter_main_safari:\n        Image|contains:\n            - 'C:\\Program Files (x86)\\Safari\\'\n            - 'C:\\Program Files\\Safari\\'\n        Image|endswith: '\\safari.exe'\n    filter_main_defender:\n        Image|contains:\n            - 'C:\\Program Files\\Windows Defender Advanced Threat Protection\\'\n            - 'C:\\Program Files\\Windows Defender\\'\n            - 'C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n        Image|endswith:\n            - '\\MsMpEng.exe' # Microsoft Defender executable\n            - '\\MsSense.exe' # Windows Defender Advanced Threat Protection Service Executable\n    filter_main_prtg:\n        # Paessler's PRTG Network Monitor\n        Image|endswith:\n            - 'C:\\Program Files (x86)\\PRTG Network Monitor\\PRTG Probe.exe'\n            - 'C:\\Program Files\\PRTG Network Monitor\\PRTG Probe.exe'\n    filter_main_brave:\n        Image|startswith: 'C:\\Program Files\\BraveSoftware\\'\n        Image|endswith: '\\brave.exe'\n    filter_main_maxthon:\n        Image|contains: '\\AppData\\Local\\Maxthon\\'\n        Image|endswith: '\\maxthon.exe'\n    filter_main_opera:\n        Image|contains: '\\AppData\\Local\\Programs\\Opera\\'\n        Image|endswith: '\\opera.exe'\n    filter_main_seamonkey:\n        Image|startswith:\n            - 'C:\\Program Files\\SeaMonkey\\'\n            - 'C:\\Program Files (x86)\\SeaMonkey\\'\n        Image|endswith: '\\seamonkey.exe'\n    filter_main_vivaldi:\n        Image|contains: '\\AppData\\Local\\Vivaldi\\'\n        Image|endswith: '\\vivaldi.exe'\n    filter_main_whale:\n        Image|startswith:\n            - 'C:\\Program Files\\Naver\\Naver Whale\\'\n            - 'C:\\Program Files (x86)\\Naver\\Naver Whale\\'\n        Image|endswith: '\\whale.exe'\n    # Note: The TOR browser shouldn't be something you allow in your corporate network.\n    # filter_main_tor:\n    #     Image|contains: '\\Tor Browser\\'\n    filter_main_whaterfox:\n        Image|startswith:\n            - 'C:\\Program Files\\Waterfox\\'\n            - 'C:\\Program Files (x86)\\Waterfox\\'\n        Image|endswith: '\\Waterfox.exe'\n    filter_main_slimbrowser:\n        Image|startswith:\n            - 'C:\\Program Files\\SlimBrowser\\'\n            - 'C:\\Program Files (x86)\\SlimBrowser\\'\n        Image|endswith: '\\slimbrowser.exe'\n    filter_main_flock:\n        Image|contains: '\\AppData\\Local\\Flock\\'\n        Image|endswith: '\\Flock.exe'\n    filter_main_phoebe:\n        Image|contains: '\\AppData\\Local\\Phoebe\\'\n        Image|endswith: '\\Phoebe.exe'\n    filter_main_falkon:\n        Image|startswith:\n            - 'C:\\Program Files\\Falkon\\'\n            - 'C:\\Program Files (x86)\\Falkon\\'\n        Image|endswith: '\\falkon.exe'\n    filter_main_qtweb:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\QtWeb\\'\n            - 'C:\\Program Files\\QtWeb\\'\n        Image|endswith: '\\QtWeb.exe'\n    filter_main_avant:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Avant Browser\\'\n            - 'C:\\Program Files\\Avant Browser\\'\n        Image|endswith: '\\avant.exe'\n    filter_main_discord:\n        Image|contains: '\\AppData\\Local\\Discord\\'\n        Image|endswith: '\\Discord.exe'\n    filter_main_null:\n        Image: null\n    filter_main_empty:\n        Image: ''\n    # filter_optional_qlik:\n    #     Image|endswith: '\\Engine.exe' # Process from qlik.com app\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1102","id":"T1102","name":"Web Service","page":"techniques/enterprise/T1102/"},{"key":"enterprise/T1102.001","id":"T1102.001","name":"Dead Drop Resolver","page":"techniques/enterprise/T1102.001/"}],"data_path":"data/detection-rules/5c80b618-0dbb-46e6-acbb-03d90bcb6d83.json","kind":"sigma"}