Sigma low test sigma

Suspicious Network Communication With IPFS

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

View Source

Detection Logic

{
  "selection": {
    "cs-uri
| re": "(?i)(ipfs\\.io/
| ipfs\\.io\\s).+\\..+@.+\\.[a-z]+"
  },
  "condition": "selection"
}

False Positives

  • ⚠ Legitimate use of IPFS being used in the organisation. However the cs-uri regex looking for a user email will likely negate this.

Field Validations

Loading…

Comments (0)

Loading comments...