Proxy Requests to IPFS URLs Containing Email Addresses

Alerts when proxy request URIs target IPFS and include an email address.

FreeUnreviewedSigmalowv1

proxy-requests-to-ipfs-urls-containing-email-addresses-eb6c2004

title: Proxy Requests to IPFS URLs Containing Email Addresses
id: 5a187dce-d70f-47b4-bdc0-87dab9051abd
status: test
description: This rule flags proxy web requests where the requested URI matches an IPFS domain and includes an email address pattern. Attackers may use IPFS to host phishing or credential-harvesting content and embed a victim’s email within the URL. The detection relies on proxy telemetry containing the full request URI (cs-uri) and matches it against a case-insensitive regular expression for IPFS plus an email-like string.
references:
  - https://blog.talosintelligence.com/ipfs-abuse/
  - https://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11
  - https://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml
author: Gavin Knapp, Huntrule Team
date: 2023-03-16
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056
logsource:
  category: proxy
detection:
  selection:
    cs-uri|re: (?i)(ipfs\.io/|ipfs\.io\s).+\..+@.+\.[a-z]+
  condition: selection
falsepositives:
  - Legitimate use of IPFS being used in the organisation. However the cs-uri regex looking for a user email will likely negate this.
level: low
license: DRL-1.1
related:
  - id: eb6c2004-1cef-427f-8885-9042974e5eb6
    type: derived

What it detects

This rule flags proxy web requests where the requested URI matches an IPFS domain and includes an email address pattern. Attackers may use IPFS to host phishing or credential-harvesting content and embed a victim’s email within the URL. The detection relies on proxy telemetry containing the full request URI (cs-uri) and matches it against a case-insensitive regular expression for IPFS plus an email-like string.

Known false positives

Legitimate use of IPFS being used in the organisation. However the cs-uri regex looking for a user email will likely negate this.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.