Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
32
4
3
1
1
Contributors
15
6
5
5
4
Categories
21
19
8
6
4
Platforms
32
8
7
3
3
Products / Services
26
5
4
4
3
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
2
1
IDS Protocols
2
This analytic identifies non-browser processes reaching out to public IP lookup or geolocation services,
such as `ipinfo.io`, `icanhazip.com`, `ip-api.com`, and others.
These domains are commonly used by legitimate tools, but their usage outside of browsers may indicate
network reconnaissance, virtual machine detection, or staging by malware.
This activity is observed in post-exploitation frameworks, stealer malware, and advanced threat actor campaigns.
The detection relies on Cisco Network Visibility Module (NVM) telemetry and excludes known browser
processes to reduce noise.
such as `ipinfo.io`, `icanhazip.com`, `ip-api.com`, and others.
These domains are commonly used by legitimate tools, but their usage outside of browsers may indicate
network reconnaissance, virtual machine detection, or staging by malware.
This activity is observed in post-exploitation frameworks, stealer malware, and advanced threat actor campaigns.
The detection relies on Cisco Network Visibility Module (NVM) telemetry and excludes known browser
processes to reduce noise.
Detects potential C2 activity associated with MQTTDoor or MatrixDoor malware by monitoring suspicious network traffic patterns. This includes unauthorized processes connecting to MQTT brokers (hivemq.com), non-chat applications interacting with a Matrix homeserver, and geo-location lookups (ip-api.com) occurring shortly after process execution.
Detects potential C2 activity associated with MQTTDoor or MatrixDoor malware by monitoring suspicious network traffic patterns. This includes unauthorized processes connecting to MQTT brokers (hivemq.com), non-chat applications interacting with a Matrix homeserver, and geo-location lookups (ip-api.com) occurring shortly after process execution.
Detects potential C2 activity associated with MQTTDoor or MatrixDoor malware by monitoring suspicious network traffic patterns. This includes unauthorized processes connecting to MQTT brokers (hivemq.com), non-chat applications interacting with a Matrix homeserver, and geo-location lookups (ip-api.com) occurring shortly after process execution.
Detects potential C2 activity associated with MQTTDoor or MatrixDoor malware by monitoring suspicious network traffic patterns. This includes unauthorized processes connecting to MQTT brokers (hivemq.com), non-chat applications interacting with a Matrix homeserver, and geo-location lookups (ip-api.com) occurring shortly after process execution.
Detects AiTM phishing page geolocation fingerprint script referencing api.country.is, setting an rcfh_country cookie, and redirecting via oauth2/v2.0/authorize.
KQL Query from file: The Hunt for QR Phisher
Detects network connections to common IP lookup services (e.g., ip-api.com, ipify.org) initiated by processes often associated with malware, such as Remcos RAT components or hijacked system processes like iexplore.exe. This activity is frequently used by adversaries for reconnaissance or C2 heartbeats to identify the external IP address of a compromised host.
Detects a specific behavioral pattern associated with Bluekit Phishing-as-a-Service (PhaaS) involving WebRTC IP address leak fingerprinting. The rule identifies UDP STUN traffic (port 3478) originating from common web browsers followed within 30 seconds by an HTTPS connection to non-reputable domains, indicating a potential client-side phishing reconnaissance or identification attempt.
Detects attempts by the Remcos RAT loader to perform WebRTC IP leakage by monitoring process command lines for keywords like 'webrtc', 'stun', 'turn', or 'ice' when initiated by common browsers (chrome.exe, firefox.exe, opera.exe) and having a parent process related to 'Remcos'. This indicates an attempt to gather victim IP addresses.
This rule detects network connections to common IP geolocation services such as ip-api.com, ipinfo.io, ipgeolocation.io, and bgpview.io. Adversaries may use these services to gather information about the victim's network, including IP addresses, geographical location, and network topology, which can aid in further targeting or reconnaissance efforts.
Detects instances of Bluekit Phishing-as-a-Service (PaaS) where the browser utilizes WebRTC RTCPeerConnection to initiate a UDP STUN request on port 3478 while concurrently accessing a suspicious web page. This behavior is used by attackers to discover the visitor's real IP address, effectively bypassing proxies or VPNs to identify security researchers or analysts.
Detects BGP route lookups used to map target IP address blocks
This rule detects instances where Windows Script Host (wscript.exe or cscript.exe) initiates a DNS query to 'ip-api.com' within a 5-minute window. This behavior is often associated with reconnaissance activity, where an adversary uses scripts to determine the public IP address or geolocation of the compromised host for C2 registration or environment awareness.
Detects Advanced IP Scanner executing from common temporary or program data directories, which is often observed in post-exploitation scenarios. This tool is frequently used by adversaries for network reconnaissance.
Detects attempts by the Remcos RAT loader to perform WebRTC IP leakage by monitoring process command lines for keywords like 'webrtc', 'stun', 'turn', or 'ice' when initiated by common browsers (chrome.exe, firefox.exe, opera.exe) and having a parent process related to 'Remcos'. This indicates an attempt to gather victim IP addresses.
This rule detects HTTP requests to known IP geolocation lookup services (ip-api.com, ipinfo.io, ipgeolocation.io). A high frequency of such requests from a single source IP within a short timeframe (10 requests in 60 seconds) could indicate reconnaissance activity, where an attacker is gathering information about target IP addresses.
This rule detects HTTP requests to known BGP route lookup services (bgp.he.net, bgpview.io, ipwhois.io). This activity is often associated with reconnaissance, specifically IP block discovery, where an attacker or red team member is gathering information about an organization's network infrastructure.
This analytic identifies non-browser processes reaching out to public IP lookup or geolocation services. These services are commonly used by legitimate tools, but their usage outside of browsers may indicate network reconnaissance, virtual machine detection, or staging by malware. This activity is observed in post-exploitation frameworks, stealer malware, and advanced threat actor campaigns. The detection relies on Cisco Network Visibility Module (NVM) telemetry and excludes known browser processes to reduce noise.
The following analytic detects processes attempting to connect to known IP check web services. This behavior is identified using Sysmon EventCode 22 logs, specifically monitoring DNS queries to services like "wtfismyip.com" and "ipinfo.io". This activity is significant as it is commonly used by malware, such as Trickbot, for reconnaissance to determine the infected machine's IP address. If confirmed malicious, this could allow attackers to gather network information, aiding in further attacks or lateral movement within the network.
The analytic detects the `wermgr.exe` process attempting to connect to known IP check web services. This activity is significant because `wermgr.exe` is typically used for Windows error reporting, and its connection to these services may indicate malicious code injection, often associated with malware like Trickbot. If confirmed malicious, this behavior could allow attackers to recon the infected machine's IP address, aiding in further exploitation and evasion tactics.
Page 1 of 3