HybridConnectionManager Service Installation - Registry

Status: test
Severity: high
Log source: category registry_event, product windows
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source: github.com/SigmaHQ/sigma

Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

MITRE ATT&CK coverage

Tactic	Techniques
Resource Development	`T1608` Stage Capabilities

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 12: RegistryEvent (Object create and delete)
Sysmon	Event ID 13: RegistryEvent (Value Set)
Sysmon	Event ID 14: RegistryEvent (Key and Value Rename)

Rule body

title: HybridConnectionManager Service Installation - Registry
id: ac8866c7-ce44-46fd-8c17-b24acff96ca8
status: test
description: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.
references:
    - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2021-04-12
modified: 2022-11-27
tags:
    - attack.resource-development
    - attack.t1608
logsource:
    category: registry_event
    product: windows
detection:
    selection1:
        TargetObject|contains: '\Services\HybridConnectionManager'
    selection2:
        EventType: SetValue
        Details|contains: 'Microsoft.HybridConnectionManager.Listener.exe'
    condition: selection1 or selection2
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection1 or selection2

Stage 1: `selection1`

selection1:
    TargetObject|contains: '\Services\HybridConnectionManager'

Stage 2: `selection2`

selection2:
    EventType: SetValue
    Details|contains: 'Microsoft.HybridConnectionManager.Listener.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	match	`Microsoft.HybridConnectionManager.Listener.exe`	`field:"Details" kind:match value:"Microsoft.HybridConnectionManager.Listener.exe"`
`EventType`	eq	`SetValue` corpus 6 (sigma 6)	`field:"EventType" kind:eq value:"SetValue"`
`TargetObject`	match	`\Services\HybridConnectionManager`	`field:"TargetObject" kind:match value:"\Services\HybridConnectionManager"`

HybridConnectionManager Service Installation - Registry

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection1

Stage 2: selection2

Indicators

Stage 0: `condition`

Stage 1: `selection1`

Stage 2: `selection2`