{"id":"edf3485d-dac4-4d50-90e4-b0e5813f7e60","title":"Suspicious Network Connection to IP Lookup Service APIs","description":"Detects external IP address lookups by non-browser processes via services such as \"api.ipify.org\". This could be indicative of potential post compromise internet test activity.","author":"Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-04-24","modified":"2024-03-22","tags":["attack.discovery","attack.t1016"],"technique_ids":["T1016"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Legitimate use of the external websites for troubleshooting or network monitoring"],"references":["https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md","https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a","https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/","https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html"],"source_path":"rules/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml","source_sha256":"ee3d69559a0049293d62cad91f8711132f7526782d051ac5062c156492be6a6c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Network Connection to IP Lookup Service APIs\nid: edf3485d-dac4-4d50-90e4-b0e5813f7e60\nrelated:\n    - id: ec82e2a5-81ea-4211-a1f8-37a0286df2c2\n      type: derived\nstatus: test\ndescription: Detects external IP address lookups by non-browser processes via services such as \"api.ipify.org\". This could be indicative of potential post compromise internet test activity.\nreferences:\n    - https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md\n    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a\n    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/\n    - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html\nauthor: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-04-24\nmodified: 2024-03-22\ntags:\n    - attack.discovery\n    - attack.t1016\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        - DestinationHostname:\n              - 'www.ip.cn'\n              - 'l2.io'\n        - DestinationHostname|contains:\n              - 'api.2ip.ua'\n              - 'api.bigdatacloud.net'\n              - 'api.ipify.org'\n              - 'bot.whatismyipaddress.com'\n              - 'canireachthe.net'\n              - 'checkip.amazonaws.com'\n              - 'checkip.dyndns.org'\n              - 'curlmyip.com'\n              - 'db-ip.com'\n              - 'edns.ip-api.com'\n              - 'eth0.me'\n              - 'freegeoip.app'\n              - 'geoipy.com'\n              - 'getip.pro'\n              - 'icanhazip.com'\n              - 'ident.me'\n              - 'ifconfig.io'\n              - 'ifconfig.me'\n              - 'ip-api.com'\n              - 'ip.360.cn'\n              - 'ip.anysrc.net'\n              - 'ip.taobao.com'\n              - 'ip.tyk.nu'\n              - 'ipaddressworld.com'\n              - 'ipapi.co'\n              - 'ipconfig.io'\n              - 'ipecho.net'\n              - 'ipinfo.io'\n              - 'ipip.net'\n              - 'ipof.in'\n              - 'ipv4.icanhazip.com'\n              - 'ipv4bot.whatismyipaddress.com'\n              - 'ipv6-test.com'\n              - 'ipwho.is'\n              - 'jsonip.com'\n              - 'myexternalip.com'\n              - 'seeip.org'\n              - 'wgetip.com'\n              - 'whatismyip.akamai.com'\n              - 'whois.pconline.com.cn'\n              - 'wtfismyip.com'\n    filter_optional_brave:\n        Image|endswith: '\\brave.exe'\n    filter_optional_chrome:\n        Image:\n            - 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n            - 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n    filter_optional_firefox:\n        Image:\n            - 'C:\\Program Files\\Mozilla Firefox\\firefox.exe'\n            - 'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'\n    filter_optional_ie:\n        Image:\n            - 'C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe'\n            - 'C:\\Program Files\\Internet Explorer\\iexplore.exe'\n    filter_optional_maxthon:\n        Image|endswith: '\\maxthon.exe'\n    filter_optional_edge_1:\n        - Image|startswith: 'C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\'\n        - Image|endswith: '\\WindowsApps\\MicrosoftEdge.exe'\n        - Image:\n              - 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n              - 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe'\n    filter_optional_edge_2:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeCore\\'\n            - 'C:\\Program Files\\Microsoft\\EdgeCore\\'\n        Image|endswith:\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n    filter_optional_opera:\n        Image|endswith: '\\opera.exe'\n    filter_optional_safari:\n        Image|endswith: '\\safari.exe'\n    filter_optional_seamonkey:\n        Image|endswith: '\\seamonkey.exe'\n    filter_optional_vivaldi:\n        Image|endswith: '\\vivaldi.exe'\n    filter_optional_whale:\n        Image|endswith: '\\whale.exe'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate use of the external websites for troubleshooting or network monitoring\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1016","id":"T1016","name":"System Network Configuration Discovery","page":"techniques/enterprise/T1016/"}],"data_path":"data/detection-rules/edf3485d-dac4-4d50-90e4-b0e5813f7e60.json","kind":"sigma"}