All Detections

Obfuscated IP Download Activity

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command

Sigma