LoFP / legitimate use of azure hybrid connection manager and the azure service bus service

Techniques

• t1554

Sample rules

DNS HybridConnectionManager Service Bus

• source: sigma
• technicques:
  • t1554

Description

Detects Azure Hybrid Connection Manager services querying the Azure service bus service

Detection logic

condition: selection
selection:
  Image|contains: HybridConnectionManager
  QueryName|contains: servicebus.windows.net