Public IP Reconnaissance Activity

edit

Identifies domains commonly used by adversaries for post-exploitation IP reconnaissance. It is common for adversaries to test for Internet access and acquire their public IP address after they have gained access to a system. Among others, this has been observed in campaigns leveraging the information stealer, Trickbot.

Rule type: query

Rule indices:

  • packetbeat-*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Network
  • Threat Detection
  • Discovery

Version: 2 (version history)

Added (Elastic Stack release): 7.10.0

Last modified (Elastic Stack release): 7.11.2

Rule authors: Elastic

Rule license: Elastic License

Potential false positives

edit

If the domains listed in this rule are used as part of an authorized workflow, this rule will be triggered by those events. Validate that this is expected activity and tune the rule to fit your environment variables.

Investigation guide

edit

This rule takes HTTP redirects and HTTP referrer’s into account, however neither HTTP redirect status codes nor HTTP referrer’s are visible with TLS traffic which can lead to multiple events per alert.

Rule query

edit
event.category:network AND event.type:connection AND
server.domain:(ipecho.net OR ipinfo.io OR ifconfig.co OR ifconfig.me
OR icanhazip.com OR myexternalip.com OR api.ipify.org OR
bot.whatismyipaddress.com OR ip.anysrc.net OR wtfismyip.com) AND NOT
http.response.status_code:302 AND status:OK AND NOT
_exists_:http.request.referrer

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 2 (7.11.2 release)
  • Formatting only