title: DNS HybridConnectionManager Service Bus
id: 7bd3902d-8b8b-4dd4-838a-c6862d40150d
status: test
description: Detects Azure Hybrid Connection Manager services querying the Azure service bus service
references:
    - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2021-04-12
modified: 2023-01-16
tags:
    - attack.persistence
    - attack.t1554
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        QueryName|contains: 'servicebus.windows.net'
        Image|contains: 'HybridConnectionManager'
    condition: selection
falsepositives:
    - Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service
level: high

title: HybridConnectionManager Service Installation
id: 0ee4d8a5-4e67-4faf-acfa-62a78457d1f2
status: test
description: Rule to detect the Hybrid Connection Manager service installation.
references:
    - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2021-04-12
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.t1554
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    selection:
        EventID: 4697
        ServiceName: HybridConnectionManager
        ServiceFileName|contains: HybridConnectionManager
    condition: selection
falsepositives:
    - Legitimate use of Hybrid Connection Manager via Azure function apps.
level: high

title: HybridConnectionManager Service Running
id: b55d23e5-6821-44ff-8a6e-67218891e49f
status: test
description: Rule to detect the Hybrid Connection Manager service running on an endpoint.
references:
    - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2021-04-12
modified: 2024-08-05
tags:
    - attack.persistence
    - attack.t1554
logsource:
    product: windows
    service: microsoft-servicebus-client # Change to servicebus-client once validators are up to date
detection:
    selection:
        EventID:
            - 40300
            - 40301
            - 40302
    keywords:
        - 'HybridConnection'
        - 'sb://'
        - 'servicebus.windows.net'
        - 'HybridConnectionManage'
    condition: selection and keywords
falsepositives:
    - Legitimate use of Hybrid Connection Manager via Azure function apps.
level: high

title: Linux Setgid Capability Set on a Binary via Setcap Utility
id: 3a716279-c18c-4488-83be-f9ececbfb9fc
status: experimental
description: |
    Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file.
    This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group).
    This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
references:
    - https://man7.org/linux/man-pages/man8/setcap.8.html
    - https://dfir.ch/posts/linux_capabilities/
    - https://juggernaut-sec.com/capabilities/#cap_setgid
author: Luc Génaux
date: 2026-01-24
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1548
    - attack.t1554
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/setcap'
        CommandLine|contains: 'cap_setgid'
    condition: selection
falsepositives:
    - Unknown
level: low

title: Linux Setuid Capability Set on a Binary via Setcap Utility
id: ed447910-bc30-4575-a598-3a2e49516a7a
status: experimental
description: |
    Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.
    This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).
    This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
references:
    - https://man7.org/linux/man-pages/man8/setcap.8.html
    - https://dfir.ch/posts/linux_capabilities/
    - https://juggernaut-sec.com/capabilities/#cap_setuid
author: Luc Génaux
date: 2026-01-24
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1548
    - attack.t1554
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/setcap'
        CommandLine|contains: 'cap_setuid'
    condition: selection
falsepositives:
    - Unknown
level: low