Potentially Suspicious Azure Front Door Connection

Description

Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2) that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)

Query · sigma

selection:
  DestinationHostname|contains: azurefd.net
filter_main_web_browsers:
  Image|endswith:
  - brave.exe
  - chrome.exe
  - chromium.exe
  - firefox.exe
  - msedge.exe
  - msedgewebview2.exe
  - opera.exe
  - vivaldi.exe
filter_main_common_talkers:
  Image|endswith: searchapp.exe
filter_main_known_benign_domains:
  DestinationHostname|contains:
  - afdxtest.z01.azurefd.net
  - fp-afd.azurefd.net
  - fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net
  - roxy.azurefd.net
  - powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net
  - storage-explorer-publishing-feapcgfgbzc2cjek.b01.azurefd.net
  - graph.azurefd.net
condition: selection and not 1 of filter_main_*

Known false positives

  • Results are not inherently suspicious, but should be investigated during threat hunting for potential cloud C2.
  • Organization-specific Azure Front Door endpoints
Raw source Potentially Suspicious Azure Front Door Connection · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Potentially Suspicious Azure Front Door Connection
id: 8cb4d14e-776e-43c2-8fb9-91e7fcea32b4
status: test
description: |
    Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2)
    that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)
references:
    - https://lots-project.com/site/2a2e617a75726566642e6e6574
    - https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
    - https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
author: Isaac Dunham
date: 2024-11-07
tags:
    - attack.command-and-control
    - attack.t1102.002
    - attack.t1090.004
    - detection.threat-hunting
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains: 'azurefd.net'
    filter_main_web_browsers:
        Image|endswith:
            - 'brave.exe'
            - 'chrome.exe'
            - 'chromium.exe'
            - 'firefox.exe'
            - 'msedge.exe'
            - 'msedgewebview2.exe'
            - 'opera.exe'
            - 'vivaldi.exe'
    filter_main_common_talkers:
        Image|endswith: 'searchapp.exe' # Windows search service uses signifcant amount of Azure FD
    filter_main_known_benign_domains:
        DestinationHostname|contains:
            - 'afdxtest.z01.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
            - 'fp-afd.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
            - 'fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
            - 'roxy.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
            - 'powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net' # Used by VS Code; Cisco Umbrella top 1m
            - 'storage-explorer-publishing-feapcgfgbzc2cjek.b01.azurefd.net' # Used by Azure Storage Explorer; Cisco Umbrella top 1m
            - 'graph.azurefd.net' # MS Graph; Cisco Umbrella top 1m
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Results are not inherently suspicious, but should be investigated during threat hunting for potential cloud C2.
    - Organization-specific Azure Front Door endpoints
level: medium

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.