Techniques
Sample rules
Azure WireServer Unusual Process Connection
- source: elastic
- technicques:
- T1082
- T1552
- T1580
Description
Identifies shells, LOLBins, GTFOBins, and scripting runtimes connecting to the Azure WireServer / HostGAPlugin address 168.63.129.16 on ports 80 or 32526. The guest agent uses this fabric endpoint for GoalState, certificates, and vmSettings. Adversaries with code execution on an Azure VM (including via Run Command) use curl, PowerShell, openssl, bun, or similar tools to enumerate versions, pull transport certificates, and read HostGAPlugin /vmSettings. Azure guest-agent binaries and system python used by waagent are excluded. Descendants of the guest agent are not excluded: Run Command payloads execute in that tree.
Detection logic
event.category: network and host.os.type: (linux or windows) and
destination.ip: "168.63.129.16" and destination.port: (80 or 32526) and
(
process.name: (
bash or dash or sh or tcsh or csh or zsh or ksh or fish or mksh or busybox or
bun or bun.exe or node or node.exe or nodejs or deno or deno.exe or
java or java.exe or javaw or javaw.exe or
curl or curl.exe or wget or wget.exe or
powershell.exe or pwsh.exe or pwsh or cmd.exe or
certutil.exe or bitsadmin.exe or mshta.exe or rundll32.exe or
wscript.exe or cscript.exe or regsvr32.exe or
openssl or openssl.exe or nc or ncat or netcat or socat or
python.exe or pythonw.exe or perl or perl.exe or ruby or ruby.exe or
php or php.exe or lua or lua.exe
) or
process.executable: (
./* or /tmp/* or /var/tmp/* or /dev/shm/* or /run/* or /var/run/* or
/home/*/* or /root/* or *\:\\Users\\* or *\:\\ProgramData\\*
)
) and
not process.executable: (
/usr/sbin/waagent or /usr/bin/waagent or /usr/bin/python3* or
/usr/lib/systemd/systemd-resolved or /lib/systemd/systemd-resolved or
*\:\\WindowsAzure\\Packages\\* or *\:\\WindowsAzure\\GuestAgent*\\* or
*\:\\WindowsAzure\\SecAgent\\*
)