Hybrid Connection Manager Service Running
This rule detects the Hybrid Connection Manager service running on a Windows endpoint. It specifically looks for Event IDs 40300, 40301, or 40302 in conjunction with keywords like 'HybridConnection', 'sb://', 'servicebus.windows.net', or 'HybridConnectionManage'. This service is used to connect on-premises resources to Azure services, and its activity could indicate legitimate cloud integration or potentially malicious use for persistence or data exfiltration.
Sigma
