Elastic low stable eql

External IP Address Discovery via Curl

Detects applications making a curl request to a known public IP address lookup web service. Malware commonly performs this action during reconnaissance to assess potential targets and identify the victim's external IP address.

View Source

Detection Logic

process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
  ((process.parent.executable like ("/Applications/*", "/Volumes/*", "/private/var/folders/*")) or
   (process.parent.name in ("bash", "sh", "zsh") and process.parent.command_line like "*http*") or
   (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false or process.code_signature.exists == false)) and
  process.name in ("curl", "nscurl") and
  process.args_count <= 5 and
  process.command_line like ("*ip-api.com*", "*ipwho.is*", "*checkip.dyndns.org*", "*api.ipify.org*",
                             "*whatismyip.akamai.com*", "*ifcfg.me*", "*ifconfig.me*", "*ident.me*",
                             "*icanhazip.com*", "*ipecho.net*", "*api.myip.com*", "*checkip.amazonaws.com*",
                             "*wtfismyip.com*", "*iplogger.*", "*freegeoip.net*", "*ipinfo.io*",
                             "*geoplugin.net*", "*httpbin.org*", "*myip.opendns.com*")

Field Validations

Loading…

Comments (0)

Loading comments...