Azure WireServer Unusual Process Connection

Identifies shells, LOLBins, GTFOBins, and scripting runtimes connecting to the Azure WireServer / HostGAPlugin address 168.63.129.16 on ports 80 or 32526. The guest agent uses this fabric endpoint for GoalState, certificates, and vmSettings. Adversaries with code execution on an Azure VM (including via Run Command) use curl, PowerShell, openssl, bun, or similar tools to enumerate versions, pull transport certificates, and read HostGAPlugin /vmSettings. Azure guest-agent binaries and system python used by waagent are excluded. Descendants of the guest agent are not excluded: Run Command payloads execute in that tree.

Rule type: new_terms
Rule indices:

  • logs-endpoint.events.network-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Domain: Cloud
  • OS: Linux
  • OS: Windows
  • Platform: Azure
  • Platform: Windows
  • Use Case: Threat Detection
  • Tactic: Credential Access
  • Tactic: Discovery
  • Data Source: Elastic Defend
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

168.63.129.16 is the Azure host-only WireServer (TCP 80) and HostGAPlugin (TCP 32526) address. Elastic Defend network events record the destination IP, port, and initiating process. They do not include the HTTP path; pair this alert with Network Packet Capture HTTP events when available (comp=certificates, /vmSettings, /versions).

Do not treat "child of waagent / WindowsAzureGuestAgent" as benign. Azure Run Command and Custom Script Extension launch attacker scripts as descendants of those agents. Exclude only the agent binaries themselves, which this query already omits by matching curl, PowerShell, and similar tools.

process.Ext.ancestry is often empty on these network events, so EQL descendant of is not reliable here.

  • Review process.name, process.executable, and process.command_line on nearby process start events. Look for comp=certificates, 32526, vmSettings, LinuxTransport, or openssl cms -decrypt.
  • Note destination.port: 32526 from curl or PowerShell is uncommon for legitimate guest-agent traffic (agents use WaAppAgent.exe, WindowsAzureGuestAgent.exe, CollectGuestLogs.exe, or /usr/bin/python3.10 / waagent).
  • Correlate with 169.254.169.254 IMDS access from the same process, especially /metadata/v1/instanceinfo (no Metadata header) or /metadata/identity/oauth2/token.
  • Check Azure Activity Logs for runCommand/action or extensions/write against this VM.
  • Search StorageRead platform logs for subsequent SAS GetBlob of vmsettings or cse objects.
  • In-house monitoring that wraps curl to WireServer. Exclude by process.executable or a signed parent after validating the script contents.
  • Do not exclude all children of the guest agent; that hides Run Command abuse.
  • Isolate the VM, rotate its managed identity and any SAS recovered from vmSettings, and review extension protectedSettings for injected configuration.
  • Remove unauthorized Run Command resources and Custom Script extensions.
  • Consider Azure Metadata Security Protocol (audit/enforce) to restrict which processes may call WireServer.
event.category: network and host.os.type: (linux or windows) and
 destination.ip: "168.63.129.16" and destination.port: (80 or 32526) and
 (
   process.name: (
     bash or dash or sh or tcsh or csh or zsh or ksh or fish or mksh or busybox or
     bun or bun.exe or node or node.exe or nodejs or deno or deno.exe or
     java or java.exe or javaw or javaw.exe or
     curl or curl.exe or wget or wget.exe or
     powershell.exe or pwsh.exe or pwsh or cmd.exe or
     certutil.exe or bitsadmin.exe or mshta.exe or rundll32.exe or
     wscript.exe or cscript.exe or regsvr32.exe or
     openssl or openssl.exe or nc or ncat or netcat or socat or
     python.exe or pythonw.exe or perl or perl.exe or ruby or ruby.exe or
     php or php.exe or lua or lua.exe
   ) or
   process.executable: (
     ./* or /tmp/* or /var/tmp/* or /dev/shm/* or /run/* or /var/run/* or
     /home/*/* or /root/* or *\:\\Users\\* or *\:\\ProgramData\\*
   )
 ) and
 not process.executable: (
   /usr/sbin/waagent or /usr/bin/waagent or /usr/bin/python3* or
   /usr/lib/systemd/systemd-resolved or /lib/systemd/systemd-resolved or
   *\:\\WindowsAzure\\Packages\\* or *\:\\WindowsAzure\\GuestAgent*\\* or
   *\:\\WindowsAzure\\SecAgent\\*
 )

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK