Query: Sigma rule for Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was of
Matching passage: Sigma rule: Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was of. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To AzureWebsites.NET By Non-Browser Process id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83 related: - id: e043f529-8514-4205-8ab0-7f7d2927b400 type: derived status: test description: 'Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site. ' references: - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/ - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 modified: 2024-07-16 tags: - attack.command-and-control - attack.t1102 - attack.t1102.001 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: azurewebsites.net filter_main_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_main_chrome_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe filter_main_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_main_firefox_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe filter_main_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_main_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_main_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_main_safari: Image|contains: - C:\Program Files (x86)\Safari\ - C:\Program Files\Safari\ Image|endswith: \safari.exe filter_main_defender: Image|contains: - C:\Program Files\Windows Defender Advanced Threat Protection\ - C:\Program Files\Windows Defender\ - C:\Pro
Near-miss passage: Sigma rule: Detects the execution of whoami that has been renamed to a different name to avoid detection. Logsource: windows / process_creation. Rule: title: Renamed Whoami Execution id: f1086bf7-a0c4-4a37-9102-01e573caf4a0 status: test description: Detects the execution of whoami that has been renamed to a different name to avoid detection references: - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/ - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/ author: Florian Roth (Nextron Systems) date: 2021-08-12 modified: 2022-10-09 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: OriginalFileName: whoami.exe filter: Image|endswith: \whoami.exe condition: selection and not filter falsepositives: - Unknown level: critical