Skip to content

Hide Navigation Hide TOC

Network Connection Initiated To AzureWebsites.NET By Non-Browser Process (5c80b618-0dbb-46e6-acbb-03d90bcb6d83)

Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

Cluster A Galaxy A Cluster B Galaxy B Level
Web Service - T1102 (830c9528-df21-472c-8c14-a036bf17d665) Attack Pattern Network Connection Initiated To AzureWebsites.NET By Non-Browser Process (5c80b618-0dbb-46e6-acbb-03d90bcb6d83) Sigma-Rules 1
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process (5c80b618-0dbb-46e6-acbb-03d90bcb6d83) Sigma-Rules Dead Drop Resolver - T1102.001 (f7827069-0bf2-4764-af4f-23fae0d181b7) Attack Pattern 1
Web Service - T1102 (830c9528-df21-472c-8c14-a036bf17d665) Attack Pattern Dead Drop Resolver - T1102.001 (f7827069-0bf2-4764-af4f-23fae0d181b7) Attack Pattern 2