Sigma rule: Potentially Suspicious Azure Front Door Connection

Rule

Title

Potentially Suspicious Azure Front Door Connection

Status

test

Level

medium

Author

Isaac Dunham

Date

2024-11-07

File

rules-threat-hunting/windows/network_connection/net_connection_win_susp_azurefd_connection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2)
that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)

Log source

product

windows

category

network_connection

Detection

selection:
    DestinationHostname|contains: 'azurefd.net'
filter_main_web_browsers:
    Image|endswith:
        - 'brave.exe'
        - 'chrome.exe'
        - 'chromium.exe'
        - 'firefox.exe'
        - 'msedge.exe'
        - 'msedgewebview2.exe'
        - 'opera.exe'
        - 'vivaldi.exe'
filter_main_common_talkers:
    Image|endswith: 'searchapp.exe' # Windows search service uses signifcant amount of Azure FD
filter_main_known_benign_domains:
    DestinationHostname|contains:
        - 'afdxtest.z01.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
        - 'fp-afd.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
        - 'fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
        - 'roxy.azurefd.net' # used by Cortana; Cisco Umbrella top 1m
        - 'powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net' # Used by VS Code; Cisco Umbrella top 1m
        - 'storage-explorer-publishing-feapcgfgbzc2cjek.b01.azurefd.net' # Used by Azure Storage Explorer; Cisco Umbrella top 1m
        - 'graph.azurefd.net' # MS Graph; Cisco Umbrella top 1m
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Results are not inherently suspicious, but should be investigated during threat hunting for potential cloud C2.
• Organization-specific Azure Front Door endpoints

Tags

• attack.command-and-control
• attack.t1102.002
• attack.t1090.004
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1090.004
• T1102.002

References

• https://lots-project.com/site/2a2e617a75726566642e6e6574
• https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
• https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/network_connection/net_connection_win_susp_azurefd_connection.yml