Suspicious Azure Front Door Connection
Detects outbound network connections to Azure Front Door (azurefd.net) that are not initiated by common web browsers or known benign applications/services. This rule aims to identify potentially suspicious use of Azure Front Door for command and control (C2) or other malicious activities, as adversaries can leverage this legitimate service for obfuscation, such as domain fronting.
Sigma
