Suspicious Obfuscated IP Download Behavior (via process_creation)

title: Suspicious Obfuscated IP Download Behavior (via process_creation)
id: 0eea05ba-5fbe-5e75-a48a-1f8965832a34
status: stable
description: This rule detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command
references:
    - https://h.43z.one/ipconverter/
    - https://twitter.com/Yasser_Elsnbary/status/1553804135354564608
    - https://twitter.com/fr0s7_/status/1712780207105404948
author: Huntrule Team
date: 2026-03-16
tags:
    - attack.discovery
    - attack.command-and-control
    - attack.defense-evasion
    - attack.t1105
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_command:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'Invoke-RestMethod'
            - 'irm '
            - 'wget '
            - 'curl '
            - 'DownloadFile'
            - 'DownloadString'
    selection_ip_1:
        CommandLine|contains:
            - ' 0x'
            - '//0x'
            - '.0x'
            - '.00x'
    selection_ip_2:
        CommandLine|contains|all:
            - 'http://%'
            - '%2e'
    selection_ip_3:
        - CommandLine|re: 'https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4}'
        - CommandLine|re: 'https?://[0-9]{1,3}\.0[0-9]{3,7}'
        - CommandLine|re: 'https?://0[0-9]{3,11}'
        - CommandLine|re: 'https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11}'
        - CommandLine|re: 'https?://0[0-9]{1,11}'
        - CommandLine|re: ' [0-7]{7,13}'
    filter_main_valid_ip:
        CommandLine|re: 'https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4}'
    condition: selection_command and 1 of selection_ip_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium