HybridConnectionManager Service Installation

Title: HybridConnectionManager Service Installation
Status: test
Description:Rule to detect the Hybrid Connection Manager service installation.
References:
  -https://twitter.com/Cyb3rWard0g/status/1381642789369286662
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2021-04-12
modified:2022-10-09
Tags:

• -'attack.persistence'
• -'attack.t1554'

Logsource:

• product: windows
• service: security
• definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697

Detection:
  selection:
    EventID: '4697'
    ServiceName: 'HybridConnectionManager'
    ServiceFileName|contains: 'HybridConnectionManager'
  condition:selection
Falsepositives:
  -Legitimate use of Hybrid Connection Manager via Azure function apps.
Level: high