mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 17:35:19 +00:00
48 lines
1.4 KiB
YAML
48 lines
1.4 KiB
YAML
title: Suspicious DNS Query for IP Lookup Service APIs
|
|
id: ec82e2a5-81ea-4211-a1f8-37a0286df2c2
|
|
description: Detects DNS queries for ip lookup services such as api.ipify.org not originating from a browser process.
|
|
status: experimental
|
|
date: 2021/07/08
|
|
modified: 2021/09/10
|
|
author: Brandon George (blog post), Thomas Patzke (rule)
|
|
references:
|
|
- https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon
|
|
- https://twitter.com/neonprimetime/status/1436376497980428318
|
|
tags:
|
|
- attack.reconnaissance
|
|
- attack.t1590
|
|
falsepositives:
|
|
- Legitimate usage of ip lookup services such as ipify API
|
|
level: medium
|
|
logsource:
|
|
product: windows
|
|
category: dns_query
|
|
detection:
|
|
dns_request:
|
|
QueryName:
|
|
- canireachthe.net
|
|
- ipv4.icanhazip.com
|
|
- ip.anysrc.net
|
|
- edns.ip-api.com
|
|
- wtfismyip.com
|
|
- checkip.dyndns.org
|
|
- api.2ip.ua
|
|
- icanhazip.com
|
|
- api.ipify.org
|
|
- ip-api.com
|
|
- checkip.amazonaws.com
|
|
- ipecho.net
|
|
- ipinfo.io
|
|
- ipv4bot.whatismyipaddress.com
|
|
- freegeoip.app
|
|
browser_process:
|
|
Image|endswith:
|
|
- \chrome.exe
|
|
- \iexplore.exe
|
|
- \firefox.exe
|
|
- \brave.exe
|
|
- \opera.exe
|
|
- \msedge.exe
|
|
- \vivaldi.exe
|
|
condition: dns_request and not browser_process
|