Query: write Sigma for Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicat
Matching passage: Sigma rule: Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicat. Logsource: windows / network_connection. Rule: title: Suspicious Network Connection to IP Lookup Service APIs id: edf3485d-dac4-4d50-90e4-b0e5813f7e60 related: - id: ec82e2a5-81ea-4211-a1f8-37a0286df2c2 type: derived status: test description: Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity. references: - https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) date: 2023-04-24 modified: 2024-03-22 tags: - attack.discovery - attack.t1016 logsource: category: network_connection product: windows detection: selection: - DestinationHostname: - www.ip.cn - l2.io - DestinationHostname|contains: - api.2ip.ua - api.bigdatacloud.net - api.ipify.org - bot.whatismyipaddress.com - canireachthe.net - checkip.amazonaws.com - checkip.dyndns.org - curlmyip.com - db-ip.com - edns.ip-api.com - eth0.me - freegeoip.app - geoipy.com - getip.pro - icanhazip.com - ident.me - ifconfig.io - ifconfig.me - ip-api.com - ip.360.cn - ip.anysrc.net - ip.taobao.com - ip.tyk.nu - ipaddressworld.com - ipapi.co - ipconfig.io - ipecho.net - ipinfo.io - ipip.net - ipof.in - ipv4.icanhazip.com - ipv4bot.whatismyipaddress.com - ipv6-test.com - ipwho.is - jsonip.com - myexternalip.com - seeip.org - wgetip.com - whatismyip.akamai.com - whois.pconline.com.cn - wtfismyip.com filter_optional_brave: Image|endswith: \brave.exe filter_optional_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_optional_maxthon: Image|endswith: \maxthon.exe filter_optional_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Mi
Near-miss passage: Sigma rule: Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Rundll32 Activity id: e593cf51-88db-4ee1-b920-37e89012a3c9 status: test description: Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities references: - http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/ - https://twitter.com/Hexacorn/status/885258886428725250 - https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52 - https://twitter.com/nas_bench/status/1433344116071583746 - https://twitter.com/eral4m/status/1479106975967240209 - https://twitter.com/eral4m/status/1479080793003671557 author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2023-05-17 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains|all: - 'javascript:' - .RegisterXLL - CommandLine|contains|all: - url.dll - OpenURL - CommandLine|contains|all: - url.dll - OpenURLA - CommandLine|contains|all: - url.dll - FileProtocolHandler - CommandLine|contains|all: - zipfldr.dll - RouteTheCall - CommandLine|contains|all: - shell32.dll - Control_RunDLL - CommandLine|contains|all: - shell32.dll - ShellExec_RunDLL - CommandLine|contains|all: - mshtml.dll - PrintHTML - CommandLine|contains|all: - advpack.dll - LaunchINFSection - CommandLine|contains|all: - advpack.dll - RegisterOCX - CommandLine|contains|all: - ieadvpack.dll - LaunchINFSection - CommandLine|contains|all: - ieadvpack.dll - RegisterOCX - CommandLine|contains|all: - ieframe.dll - OpenURL - CommandLine|contains|all: - shdocvw.dll - OpenURL - CommandLine|contains|all: - syssetup.dll - SetupInfObjectInstallAction - CommandLine|contains|all: - setupapi.dll - InstallHinfSection - CommandLine|contains|all: - pcwutl.dll - LaunchApplication - CommandLine|contains|all: - dfshim.dll - ShOpenVerbApplication - CommandLine|contains|all: - dfshim.dll - ShOpenVerbShortcut - CommandLine|contains|all: - scrobj.dll - GenerateTypeLib - http - CommandLine|contains|all: - shimgvw.dll - ImageView_Fullscreen - http - CommandLine|contains|all: - comsvcs.dll - MiniDump filter_main_screensaver: CommandLine|contains: shell32.dll,Control_RunDLL desk.cpl,screensaver,@screensaver filter_main_parent_cpl: ParentImage: C:\Windows\System32\control.exe ParentCommandLine|contains: .cpl CommandLine|contains|all: - Shell32.dll - Control_RunDLL - .cpl filter_main_startmenu: ParentImage: