Network Connection to AzureWebsites.NET by Non-Browser Process

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•17

Detects an initiated network connection by a non-browser process on the system to "azurewebsites.net". This domain has been frequently used by threat actors for malware hosting and data exfiltration. The rule filters out connections made by common web browsers and other legitimate applications to reduce false positives.