valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 09:25:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update net_susp_ipify.yml

Browse Source
This commit is contained in:
frack113 2021-09-11 08:31:24 +02:00 committed by GitHub
parent 033494c8f7
commit 8d3a77d1f5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
rules/network/net_susp_ipify.yml
View File

@ -3,6 +3,7 @@ id: ec82e2a5-81ea-4211-a1f8-37a0286df2c2
description: Detects DNS queries for ip lookup services such as api.ipify.org not originating from a browser process.
status: experimental
date: 2021/07/08
modified: 2021/09/10
author: Brandon George (blog post), Thomas Patzke (rule)
references:
- https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon