BQTLock/Non-Browser IP Reconnaissance Followed by New External Outbound Connection
This rule detects processes that perform a DNS query or network connection to common public IP geolocation services (e.g., ipify, icanhazip) followed by an outbound network connection to an external destination within a short time frame. It excludes common browser processes and standard system utilities, aiming to identify potentially malicious programs, custom scripts, or living-off-the-land binaries performing reconnaissance of the host's public network identity followed by external connectivity.
Splunk (SPL)
