Suspicious Network Connection to IP Lookup Service APIs
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_network_connection" AND (DESTINATIONHOST = "www.ip.cn,l2.io" OR (DESTINATIONHOST contains "api.2ip.ua,api.bigdatacloud.net,api.ipify.org,bot.whatismyipaddress.com,canireachthe.net,checkip.amazonaws.com,checkip.dyndns.org,curlmyip.com,db-ip.com,edns.ip-api.com,eth0.me,freegeoip.app,geoipy.com,getip.pro,icanhazip.com,ident.me,ifconfig.io,ifconfig.me,ip-api.com,ip.360.cn,ip.anysrc.net" OR DESTINATIONHOST contains "ip.taobao.com,ip.tyk.nu,ipaddressworld.com,ipapi.co,ipconfig.io,ipecho.net,ipinfo.io,ipip.net,ipof.in,ipv4.icanhazip.com,ipv4bot.whatismyipaddress.com,ipv6-test.com,ipwho.is,jsonip.com,myexternalip.com,seeip.org,wgetip.com,whatismyip.akamai.com,whois.pconline.com.cn,wtfismyip.com")) AND (PROCESSNAME notendswith "\brave.exe" AND PROCESSNAME != "C:\Program Files\Google\Chrome\Application\chrome.exe,C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" AND PROCESSNAME != "C:\Program Files\Mozilla Firefox\firefox.exe,C:\Program Files (x86)\Mozilla Firefox\firefox.exe" AND PROCESSNAME != "C:\Program Files (x86)\Internet Explorer\iexplore.exe,C:\Program Files\Internet Explorer\iexplore.exe" AND PROCESSNAME notendswith "\maxthon.exe" AND (PROCESSNAME notstartswith "C:\Program Files (x86)\Microsoft\EdgeWebView\Application" AND PROCESSNAME notendswith "\WindowsApps\MicrosoftEdge.exe" AND PROCESSNAME != "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,C:\Program Files\Microsoft\Edge\Application\msedge.exe") AND (PROCESSNAME notstartswith "C:\Program Files (x86)\Microsoft\EdgeCore\,C:\Program Files\Microsoft\EdgeCore" OR PROCESSNAME notendswith "\msedge.exe,\msedgewebview2.exe") AND PROCESSNAME notendswith "\opera.exe" AND PROCESSNAME notendswith "\safari.exe" AND PROCESSNAME notendswith "\seamonkey.exe" AND PROCESSNAME notendswith "\vivaldi.exe" AND PROCESSNAME notendswith "\whale.exe") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
