{"id":"ec82e2a5-81ea-4211-a1f8-37a0286df2c2","title":"Suspicious DNS Query for IP Lookup Service APIs","description":"Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.","author":"Brandon George (blog post), Thomas Patzke","status":"test","level":"medium","date":"2021-07-08","modified":"2024-03-22","tags":["attack.reconnaissance","attack.t1590"],"technique_ids":["T1590"],"logsource":{"product":"windows","category":"dns_query"},"falsepositives":["Legitimate usage of IP lookup services such as ipify API"],"references":["https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon","https://twitter.com/neonprimetime/status/1436376497980428318","https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html"],"source_path":"rules/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml","source_sha256":"d7a856d036daacafcb331dade4769562a84e946a105479ae3c864f579d2c675d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious DNS Query for IP Lookup Service APIs\nid: ec82e2a5-81ea-4211-a1f8-37a0286df2c2\nstatus: test\ndescription: Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.\nreferences:\n    - https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon\n    - https://twitter.com/neonprimetime/status/1436376497980428318\n    - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html\nauthor: Brandon George (blog post), Thomas Patzke\ndate: 2021-07-08\nmodified: 2024-03-22\ntags:\n    - attack.reconnaissance\n    - attack.t1590\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        - QueryName:\n              - 'www.ip.cn'\n              - 'l2.io'\n        - QueryName|contains:\n              - 'api.2ip.ua'\n              - 'api.bigdatacloud.net'\n              - 'api.ipify.org'\n              - 'bot.whatismyipaddress.com'\n              - 'canireachthe.net'\n              - 'checkip.amazonaws.com'\n              - 'checkip.dyndns.org'\n              - 'curlmyip.com'\n              - 'db-ip.com'\n              - 'edns.ip-api.com'\n              - 'eth0.me'\n              - 'freegeoip.app'\n              - 'geoipy.com'\n              - 'getip.pro'\n              - 'icanhazip.com'\n              - 'ident.me'\n              - 'ifconfig.io'\n              - 'ifconfig.me'\n              - 'ip-api.com'\n              - 'ip.360.cn'\n              - 'ip.anysrc.net'\n              - 'ip.taobao.com'\n              - 'ip.tyk.nu'\n              - 'ipaddressworld.com'\n              - 'ipapi.co'\n              - 'ipconfig.io'\n              - 'ipecho.net'\n              - 'ipinfo.io'\n              - 'ipip.net'\n              - 'ipof.in'\n              - 'ipv4.icanhazip.com'\n              - 'ipv4bot.whatismyipaddress.com'\n              - 'ipv6-test.com'\n              - 'ipwho.is'\n              - 'jsonip.com'\n              - 'myexternalip.com'\n              - 'seeip.org'\n              - 'wgetip.com'\n              - 'whatismyip.akamai.com'\n              - 'whois.pconline.com.cn'\n              - 'wtfismyip.com'\n    filter_optional_brave:\n        Image|endswith: '\\brave.exe'\n    filter_optional_chrome:\n        Image:\n            - 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n            - 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n    filter_optional_firefox:\n        Image:\n            - 'C:\\Program Files\\Mozilla Firefox\\firefox.exe'\n            - 'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'\n    filter_optional_ie:\n        Image:\n            - 'C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe'\n            - 'C:\\Program Files\\Internet Explorer\\iexplore.exe'\n    filter_optional_maxthon:\n        Image|endswith: '\\maxthon.exe'\n    filter_optional_edge_1:\n        - Image|startswith: 'C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\'\n        - Image|endswith: '\\WindowsApps\\MicrosoftEdge.exe'\n        - Image:\n              - 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n              - 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe'\n    filter_optional_edge_2:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeCore\\'\n            - 'C:\\Program Files\\Microsoft\\EdgeCore\\'\n        Image|endswith:\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n    filter_optional_opera:\n        Image|endswith: '\\opera.exe'\n    filter_optional_safari:\n        Image|endswith: '\\safari.exe'\n    filter_optional_seamonkey:\n        Image|endswith: '\\seamonkey.exe'\n    filter_optional_vivaldi:\n        Image|endswith: '\\vivaldi.exe'\n    filter_optional_whale:\n        Image|endswith: '\\whale.exe'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate usage of IP lookup services such as ipify API\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1590","id":"T1590","name":"Gather Victim Network Information","page":"techniques/enterprise/T1590/"}],"data_path":"data/detection-rules/ec82e2a5-81ea-4211-a1f8-37a0286df2c2.json","kind":"sigma"}