Windows Process Creation: Obfuscated IP Address in Download Command URLs
Alerts on Windows download commands that include obfuscated/encoded IP addresses in the URL.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-03
- Updated
- 2026-07-30
What it detects
This rule flags Windows command-line activity where common download tools (e.g., PowerShell web requests/rest methods or curl/wget equivalents) are used with URLs that contain IP addresses in obfuscated forms such as hex prefixes, percent-encoded fragments, or regex-matched non-standard numeric encodings. Obfuscation can help attackers conceal outbound destinations or payload sources while still using download functionality. It relies on process creation telemetry with command-line content to identify both the download command and the presence of suspicious IP encodings, excluding matches that resolve to a standard IPv4 URL pattern.
Reporting behind it
- h.43z.onehttps://h.43z.one/ipconverter/
- twitter.comhttps://twitter.com/Yasser_Elsnbary/status/1553804135354564608
- twitter.comhttps://twitter.com/fr0s7_/status/1712780207105404948
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Obfuscated IP Address in Download Command URLs"
id: e5178648-a4a2-4283-98ef-14ca5af86dd0
status: test
description: This rule flags Windows command-line activity where common download tools (e.g., PowerShell web requests/rest methods or curl/wget equivalents) are used with URLs that contain IP addresses in obfuscated forms such as hex prefixes, percent-encoded fragments, or regex-matched non-standard numeric encodings. Obfuscation can help attackers conceal outbound destinations or payload sources while still using download functionality. It relies on process creation telemetry with command-line content to identify both the download command and the presence of suspicious IP encodings, excluding matches that resolve to a standard IPv4 URL pattern.
references:
- https://h.43z.one/ipconverter/
- https://twitter.com/Yasser_Elsnbary/status/1553804135354564608
- https://twitter.com/fr0s7_/status/1712780207105404948
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml
author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2022-08-03
modified: 2026-03-16
tags:
- attack.discovery
logsource:
category: process_creation
product: windows
detection:
selection_command:
CommandLine|contains:
- Invoke-WebRequest
- "iwr "
- Invoke-RestMethod
- "irm "
- "wget "
- "curl "
- DownloadFile
- DownloadString
selection_ip_1:
CommandLine|contains:
- " 0x"
- //0x
- .0x
- .00x
selection_ip_2:
CommandLine|contains|all:
- http://%
- "%2e"
selection_ip_3:
- CommandLine|re: https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4}
- CommandLine|re: https?://[0-9]{1,3}\.0[0-9]{3,7}
- CommandLine|re: https?://0[0-9]{3,11}
- CommandLine|re: https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11}
- CommandLine|re: https?://0[0-9]{1,11}
- CommandLine|re: " [0-7]{7,13}"
filter_main_valid_ip:
CommandLine|re: https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4}
condition: selection_command and 1 of selection_ip_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: cb5a2333-56cf-4562-8fcb-22ba1bca728d
type: derived