(SIGMA) SIGMA_check_external_ip

June 20, 2022, midnight | 2 weeks, 2 days
            title: Check external IP via Powershell
status: experimental
description: Check external IP via Powershell
author: Joe Security
date: 2020-07-20
id: 200081
threatname:
behaviorgroup: 8
classification: 6
mitreattack:

logsource:
      category: process_creation
      product: windows
detection:
      selection:      
          CommandLine:
              - '*powershell*api.ipify.org*'
      condition: selection
level: critical
        

Associated Techniques

Comment