huntrule

Suspicious Windows Network Connections to External IP Lookup Service APIs

Alerts on non-browser outbound connections from Windows hosts to public IP lookup API domains.

FreeReviewedSigma · Medium · v2
Product
windows
Category
network_connection
Author
Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-04-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies outbound connections from Windows hosts to common external IP lookup and geolocation-related APIs (for example, ipify.org and ipinfo.io) based on the destination hostname. Attackers may use these services during discovery and testing to determine their outward-facing IP address or validate network egress behavior post-compromise. Detection relies on network connection telemetry including destination hostname and the process image to optionally suppress common browser traffic.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange
Suspicious Codepage Change Followed By Nltest Domain Trust Discovery
Suspicious Domain Trust Discovery Via Nltest
Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)
Suspicious Scheduled Task Enumerated (via process_creation)
Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)
Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)
Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)
Suspicious External IP Discovery via curl to ifconfig.me via process_creation
Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)
Suspicious Windows Network Connections to External IP Lookup Service APIs
Pivot detection · T1016 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.