Azure WireServer Unusual Process Connection

  1[metadata]
  2creation_date = "2026/08/17"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/10"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies shells, LOLBins, GTFOBins, and scripting runtimes connecting to the Azure WireServer / HostGAPlugin address
 11168.63.129.16 on ports 80 or 32526. The guest agent uses this fabric endpoint for GoalState, certificates, and
 12vmSettings. Adversaries with code execution on an Azure VM (including via Run Command) use curl, PowerShell, openssl,
 13bun, or similar tools to enumerate versions, pull transport certificates, and read HostGAPlugin /vmSettings. Azure
 14guest-agent binaries and system python used by waagent are excluded. Descendants of the guest agent are not excluded:
 15Run Command payloads execute in that tree.
 16"""
 17false_positives = [
 18    """
 19    Custom inventory or health scripts that call WireServer with curl or PowerShell. Validate the command line and
 20    exclude the specific signed binary or scheduled task after review.
 21    """,
 22    """
 23    Break-glass troubleshooting by administrators using curl against 168.63.129.16. Confirm the change window and
 24    exclude the admin host or user if the activity is authorized.
 25    """,
 26]
 27from = "now-9m"
 28index = ["logs-endpoint.events.network-*"]
 29language = "kuery"
 30license = "Elastic License v2"
 31name = "Azure WireServer Unusual Process Connection"
 32note = """## Triage and analysis
 33
 34### Investigating Azure WireServer Unusual Process Connection
 35
 36`168.63.129.16` is the Azure host-only WireServer (TCP 80) and HostGAPlugin (TCP 32526) address. Elastic Defend
 37network events record the destination IP, port, and initiating process. They do not include the HTTP path; pair this
 38alert with Network Packet Capture HTTP events when available (`comp=certificates`, `/vmSettings`, `/versions`).
 39
 40Do not treat "child of waagent / WindowsAzureGuestAgent" as benign. Azure Run Command and Custom Script Extension
 41launch attacker scripts as descendants of those agents. Exclude only the agent binaries themselves, which this query
 42already omits by matching curl, PowerShell, and similar tools.
 43
 44`process.Ext.ancestry` is often empty on these network events, so EQL `descendant of` is not reliable here.
 45
 46### Possible investigation steps
 47
 48- Review `process.name`, `process.executable`, and `process.command_line` on nearby process start events. Look for
 49  `comp=certificates`, `32526`, `vmSettings`, `LinuxTransport`, or `openssl cms -decrypt`.
 50- Note `destination.port`: 32526 from curl or PowerShell is uncommon for legitimate guest-agent traffic (agents use
 51  `WaAppAgent.exe`, `WindowsAzureGuestAgent.exe`, `CollectGuestLogs.exe`, or `/usr/bin/python3.10` / waagent).
 52- Correlate with `169.254.169.254` IMDS access from the same process, especially `/metadata/v1/instanceinfo` (no
 53  Metadata header) or `/metadata/identity/oauth2/token`.
 54- Check Azure Activity Logs for `runCommand/action` or extensions/write against this VM.
 55- Search StorageRead platform logs for subsequent SAS GetBlob of vmsettings or cse objects.
 56
 57### False positive analysis
 58
 59- In-house monitoring that wraps curl to WireServer. Exclude by `process.executable` or a signed parent after
 60  validating the script contents.
 61- Do not exclude all children of the guest agent; that hides Run Command abuse.
 62
 63### Response and remediation
 64
 65- Isolate the VM, rotate its managed identity and any SAS recovered from vmSettings, and review extension
 66  protectedSettings for injected configuration.
 67- Remove unauthorized Run Command resources and Custom Script extensions.
 68- Consider Azure Metadata Security Protocol (audit/enforce) to restrict which processes may call WireServer.
 69"""
 70references = [
 71    "https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/",
 72    "https://cybercx.com.au/blog/azure-ssrf-metadata/",
 73    "https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services",
 74    "https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16",
 75]
 76risk_score = 47
 77rule_id = "2dba3edf-1e23-4ead-a76f-458ef2060d24"
 78severity = "medium"
 79tags = [
 80    "Domain: Endpoint",
 81    "Domain: Cloud",
 82    "OS: Linux",
 83    "OS: Windows",
 84    "Platform: Azure",
 85    "Platform: Windows",
 86    "Use Case: Threat Detection",
 87    "Tactic: Credential Access",
 88    "Tactic: Discovery",
 89    "Data Source: Elastic Defend",
 90    "Resources: Investigation Guide",
 91]
 92timestamp_override = "event.ingested"
 93type = "new_terms"
 94
 95query = '''
 96event.category: network and host.os.type: (linux or windows) and
 97 destination.ip: "168.63.129.16" and destination.port: (80 or 32526) and
 98 (
 99   process.name: (
100     bash or dash or sh or tcsh or csh or zsh or ksh or fish or mksh or busybox or
101     bun or bun.exe or node or node.exe or nodejs or deno or deno.exe or
102     java or java.exe or javaw or javaw.exe or
103     curl or curl.exe or wget or wget.exe or
104     powershell.exe or pwsh.exe or pwsh or cmd.exe or
105     certutil.exe or bitsadmin.exe or mshta.exe or rundll32.exe or
106     wscript.exe or cscript.exe or regsvr32.exe or
107     openssl or openssl.exe or nc or ncat or netcat or socat or
108     python.exe or pythonw.exe or perl or perl.exe or ruby or ruby.exe or
109     php or php.exe or lua or lua.exe
110   ) or
111   process.executable: (
112     ./* or /tmp/* or /var/tmp/* or /dev/shm/* or /run/* or /var/run/* or
113     /home/*/* or /root/* or *\:\\Users\\* or *\:\\ProgramData\\*
114   )
115 ) and
116 not process.executable: (
117   /usr/sbin/waagent or /usr/bin/waagent or /usr/bin/python3* or
118   /usr/lib/systemd/systemd-resolved or /lib/systemd/systemd-resolved or
119   *\:\\WindowsAzure\\Packages\\* or *\:\\WindowsAzure\\GuestAgent*\\* or
120   *\:\\WindowsAzure\\SecAgent\\*
121 )
122'''
123
124
125[[rule.threat]]
126framework = "MITRE ATT&CK"
127[[rule.threat.technique]]
128id = "T1552"
129name = "Unsecured Credentials"
130reference = "https://attack.mitre.org/techniques/T1552/"
131[[rule.threat.technique.subtechnique]]
132id = "T1552.005"
133name = "Cloud Instance Metadata API"
134reference = "https://attack.mitre.org/techniques/T1552/005/"
135
136
137
138[rule.threat.tactic]
139id = "TA0006"
140name = "Credential Access"
141reference = "https://attack.mitre.org/tactics/TA0006/"
142[[rule.threat]]
143framework = "MITRE ATT&CK"
144[[rule.threat.technique]]
145id = "T1082"
146name = "System Information Discovery"
147reference = "https://attack.mitre.org/techniques/T1082/"
148
149[[rule.threat.technique]]
150id = "T1580"
151name = "Cloud Infrastructure Discovery"
152reference = "https://attack.mitre.org/techniques/T1580/"
153
154
155[rule.threat.tactic]
156id = "TA0007"
157name = "Discovery"
158reference = "https://attack.mitre.org/tactics/TA0007/"
159
160[rule.new_terms]
161field = "new_terms_fields"
162value = ["host.id", "process.executable"]
163[[rule.new_terms.history_window_start]]
164field = "history_window_start"
165value = "now-7d"