detection.wiki

Detection rules › Splunk

Windows Gather Victim Network Info Through Ip Check Web Services

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic detects processes attempting to connect to known IP check web services. This behavior is identified using Sysmon EventCode 22 logs, specifically monitoring DNS queries to services like "wtfismyip.com" and "ipinfo.io". This activity is significant as it is commonly used by malware, such as Trickbot, for reconnaissance to determine the infected machine's IP address. If confirmed malicious, this could allow attackers to gather network information, aiding in further attacks or lateral movement within the network.

MITRE ATT&CK coverage

TacticTechniques
ReconnaissanceT1590.005 Gather Victim Network Information: IP Addresses

Event coverage

ProviderEvent IDTitle
Sysmon22DNSEvent (DNS query)

Stages and Predicates

Stage 1: search

search EventCode=22 QueryName IN ("*api.ip.sb", "*api.ipify.org", "*b.barracudacentral.org", "*cbl.abuseat.org", "*checkip.*", "*dnsbl-1.uceprotect.net", "*freegeoip.app*", "*geoip.*", "*icanhazip.*", "*icanhazip.com", "*ifconfig.me*", "*ip-api.com*", "*ip-api.io*", "*ip.anysrc.com", "*ipecho.net", "*ipfind.io*", "*ipgeolocation.io*", "*ipinfo.io", "*iplogger.org*", "*ipstack.com*", "*ipv4bot.whatismyipaddress.com*", "*ipwho.is*", "*myexternalip.com*", "*myip.com*", "*spam.dnsbl.sorbs.net", "*trackip.net*", "*wtfismyip.com", "*zen.spamhaus.org", "ident.me", "www.myexternalip.com")

Stage 2: stats

stats BY answer, answer_count, dvc, process_exec, process_guid, process_name, query, query_count, reply_code_id, signature, signature_id, src, user_id, vendor_product, QueryName, QueryResults, QueryStatus

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 22 corpus 15 (splunk 15)
QueryNamein
  • "*api.ip.sb" corpus 2 (splunk 2)
  • "*api.ipify.org" corpus 2 (splunk 2)
  • "*b.barracudacentral.org" corpus 2 (splunk 2)
  • "*cbl.abuseat.org" corpus 2 (splunk 2)
  • "*checkip.*"
  • "*dnsbl-1.uceprotect.net" corpus 2 (splunk 2)
  • "*freegeoip.app*"
  • "*geoip.*"
  • "*icanhazip.*"
  • "*icanhazip.com" corpus 2 (splunk 2)
  • "*ifconfig.me*"
  • "*ip-api.com*"
  • "*ip-api.io*"
  • "*ip.anysrc.com" corpus 2 (splunk 2)
  • "*ipecho.net" corpus 2 (splunk 2)
  • "*ipfind.io*"
  • "*ipgeolocation.io*"
  • "*ipinfo.io" corpus 2 (splunk 2)
  • "*iplogger.org*"
  • "*ipstack.com*"
  • "*ipv4bot.whatismyipaddress.com*"
  • "*ipwho.is*"
  • "*myexternalip.com*"
  • "*myip.com*"
  • "*spam.dnsbl.sorbs.net" corpus 2 (splunk 2)
  • "*trackip.net*"
  • "*wtfismyip.com" corpus 2 (splunk 2)
  • "*zen.spamhaus.org" corpus 2 (splunk 2)
  • "ident.me" corpus 2 (splunk 2)
  • "www.myexternalip.com" corpus 2 (splunk 2)