Suspicious DNS Query for IP Lookup Service APIs from Non-Browser Process
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non-browser process. This behavior can indicate reconnaissance activity by malware or an attacker attempting to determine the external IP address of a compromised system.
Sigma
