Obfuscated IP Download Activity

SigmaHQ Detections@sigmaHQ

•updated Jul 28, 2025•1•0•14

Detects the use of encoded or obfuscated IP addresses (hex, octal, etc.) within a URL in conjunction with common download commands. This technique is often used by adversaries to evade simple network-based detections or to obscure their infrastructure.