{"id":"e043f529-8514-4205-8ab0-7f7d2927b400","title":"DNS Query To AzureWebsites.NET By Non-Browser Process","description":"Detects a DNS query by a non browser process on the system to \"azurewebsites.net\". The latter was often used by threat actors as a malware hosting and exfiltration site.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-06-24","modified":"","tags":["attack.command-and-control","attack.t1219.002"],"technique_ids":["T1219.002"],"logsource":{"product":"windows","category":"dns_query"},"falsepositives":["Likely with other browser software. Apply additional filters for any other browsers you might use."],"references":["https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/","https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/"],"source_path":"rules/windows/dns_query/dns_query_win_domain_azurewebsites.yml","source_sha256":"4a588a54fca7f62385e1c923e61f9835fa2f3d3bfc4875ad91425e472d1bc59d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_domain_azurewebsites.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DNS Query To AzureWebsites.NET By Non-Browser Process\nid: e043f529-8514-4205-8ab0-7f7d2927b400\nrelated:\n    - id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83\n      type: derived\nstatus: test\ndescription: |\n    Detects a DNS query by a non browser process on the system to \"azurewebsites.net\". The latter was often used by threat actors as a malware hosting and exfiltration site.\nreferences:\n    - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/\n    - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia\n    - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/\n    - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2024-06-24\ntags:\n    - attack.command-and-control\n    - attack.t1219.002\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|endswith: 'azurewebsites.net'\n    filter_optional_chrome:\n        Image:\n            - 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n            - 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n    filter_optional_firefox:\n        Image:\n            - 'C:\\Program Files\\Mozilla Firefox\\firefox.exe'\n            - 'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'\n    filter_optional_ie:\n        Image:\n            - 'C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe'\n            - 'C:\\Program Files\\Internet Explorer\\iexplore.exe'\n    filter_optional_edge_1:\n        - Image|startswith: 'C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\'\n        - Image|endswith: '\\WindowsApps\\MicrosoftEdge.exe'\n        - Image:\n              - 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n              - 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe'\n    filter_optional_edge_2:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeCore\\'\n            - 'C:\\Program Files\\Microsoft\\EdgeCore\\'\n        Image|endswith:\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n    filter_optional_safari:\n        Image|endswith: '\\safari.exe'\n    filter_optional_defender:\n        Image|endswith:\n            - '\\MsMpEng.exe' # Microsoft Defender executable\n            - '\\MsSense.exe' # Windows Defender Advanced Threat Protection Service Executable\n    filter_optional_brave:\n        Image|endswith: '\\brave.exe'\n        Image|startswith: 'C:\\Program Files\\BraveSoftware\\'\n    filter_optional_maxthon:\n        Image|contains: '\\AppData\\Local\\Maxthon\\'\n        Image|endswith: '\\maxthon.exe'\n    filter_optional_opera:\n        Image|contains: '\\AppData\\Local\\Programs\\Opera\\'\n        Image|endswith: '\\opera.exe'\n    filter_optional_seamonkey:\n        Image|startswith:\n            - 'C:\\Program Files\\SeaMonkey\\'\n            - 'C:\\Program Files (x86)\\SeaMonkey\\'\n        Image|endswith: '\\seamonkey.exe'\n    filter_optional_vivaldi:\n        Image|contains: '\\AppData\\Local\\Vivaldi\\'\n        Image|endswith: '\\vivaldi.exe'\n    filter_optional_whale:\n        Image|startswith:\n            - 'C:\\Program Files\\Naver\\Naver Whale\\'\n            - 'C:\\Program Files (x86)\\Naver\\Naver Whale\\'\n        Image|endswith: '\\whale.exe'\n    filter_optional_tor:\n        Image|contains: '\\Tor Browser\\'\n    filter_optional_whaterfox:\n        Image|startswith:\n            - 'C:\\Program Files\\Waterfox\\'\n            - 'C:\\Program Files (x86)\\Waterfox\\'\n        Image|endswith: '\\Waterfox.exe'\n    filter_optional_midori:\n        Image|contains: '\\AppData\\Local\\Programs\\midori-ng\\'\n        Image|endswith: '\\Midori Next Generation.exe'\n    filter_optional_slimbrowser:\n        Image|startswith:\n            - 'C:\\Program Files\\SlimBrowser\\'\n            - 'C:\\Program Files (x86)\\SlimBrowser\\'\n        Image|endswith: '\\slimbrowser.exe'\n    filter_optional_flock:\n        Image|contains: '\\AppData\\Local\\Flock\\'\n        Image|endswith: '\\Flock.exe'\n    filter_optional_phoebe:\n        Image|contains: '\\AppData\\Local\\Phoebe\\'\n        Image|endswith: '\\Phoebe.exe'\n    filter_optional_falkon:\n        Image|startswith:\n            - 'C:\\Program Files\\Falkon\\'\n            - 'C:\\Program Files (x86)\\Falkon\\'\n        Image|endswith: '\\falkon.exe'\n    filter_optional_avant:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Avant Browser\\'\n            - 'C:\\Program Files\\Avant Browser\\'\n        Image|endswith: '\\avant.exe'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Likely with other browser software. Apply additional filters for any other browsers you might use.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1219.002","id":"T1219.002","name":"Remote Desktop Software","page":"techniques/enterprise/T1219.002/"}],"data_path":"data/detection-rules/e043f529-8514-4205-8ab0-7f7d2927b400.json","kind":"sigma"}