title: Check external IP via Powershell status: experimental description: Check external IP via Powershell author: Joe Security date: 2020-07-20 id: 200081 threatname: behaviorgroup: 8 classification: 6 mitreattack: logsource: category: process_creation product: windows detection: selection: CommandLine: - '*powershell*api.ipify.org*' condition: selection level: critical