Query: detection rule: Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was of
Matching passage: Sigma rule: Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was of. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To AzureWebsites.NET By Non-Browser Process id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83 related: - id: e043f529-8514-4205-8ab0-7f7d2927b400 type: derived status: test description: 'Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site. ' references: - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/ - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 modified: 2024-07-16 tags: - attack.command-and-control - attack.t1102 - attack.t1102.001 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: azurewebsites.net filter_main_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_main_chrome_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe filter_main_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_main_firefox_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe filter_main_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_main_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_main_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_main_safari: Image|contains: - C:\Program Files (x86)\Safari\ - C:\Program Files\Safari\ Image|endswith: \safari.exe filter_main_defender: Image|contains: - C:\Program Files\Windows Defender Advanced Threat Protection\ - C:\Program Files\Windows Defender\ - C:\Pro
Near-miss passage: Sigma rule: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin pr. Logsource: windows / process_creation. Rule: title: Writing Of Malicious Files To The Fonts Folder id: ae9b0bd7-8888-4606-b444-0ed7410cb728 status: test description: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ author: Sreeman date: 2020-04-21 modified: 2022-03-08 tags: - attack.stealth - attack.t1211 - attack.t1059 - attack.persistence - attack.execution logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: - echo - copy - type - file createnew - cacls selection_2: CommandLine|contains: C:\Windows\Fonts\ selection_3: CommandLine|contains: - .sh - .exe - .dll - .bin - .bat - .cmd - .js - .msh - .reg - .scr - .ps - .vb - .jar - .pl - '.inf' - .cpl - .hta - .msi - .vbs condition: all of selection_* falsepositives: - Unknown level: medium