HybridConnectionManager Service Installation
This rule detects the installation of the 'HybridConnectionManager' service on a Windows system. This service is part of Azure Hybrid Connection Manager, which allows Azure services to connect to on-premises resources. While legitimate, its installation could also be leveraged by an attacker to establish persistence or facilitate data exfiltration from an compromised environment to Azure resources.
Sigma
