Windows Process Creation: Obfuscated IP Address in Download Command URLs

title: "Windows Process Creation: Obfuscated IP Address in Download Command URLs"
id: e5178648-a4a2-4283-98ef-14ca5af86dd0
status: test
description: This rule flags Windows command-line activity where common download tools (e.g., PowerShell web requests/rest methods or curl/wget equivalents) are used with URLs that contain IP addresses in obfuscated forms such as hex prefixes, percent-encoded fragments, or regex-matched non-standard numeric encodings. Obfuscation can help attackers conceal outbound destinations or payload sources while still using download functionality. It relies on process creation telemetry with command-line content to identify both the download command and the presence of suspicious IP encodings, excluding matches that resolve to a standard IPv4 URL pattern.
references:
  - https://h.43z.one/ipconverter/
  - https://twitter.com/Yasser_Elsnbary/status/1553804135354564608
  - https://twitter.com/fr0s7_/status/1712780207105404948
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml
author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2022-08-03
modified: 2026-03-16
tags:
  - attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection_command:
    CommandLine|contains:
      - Invoke-WebRequest
      - "iwr "
      - Invoke-RestMethod
      - "irm "
      - "wget "
      - "curl "
      - DownloadFile
      - DownloadString
  selection_ip_1:
    CommandLine|contains:
      - " 0x"
      - //0x
      - .0x
      - .00x
  selection_ip_2:
    CommandLine|contains|all:
      - http://%
      - "%2e"
  selection_ip_3:
    - CommandLine|re: https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4}
    - CommandLine|re: https?://[0-9]{1,3}\.0[0-9]{3,7}
    - CommandLine|re: https?://0[0-9]{3,11}
    - CommandLine|re: https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11}
    - CommandLine|re: https?://0[0-9]{1,11}
    - CommandLine|re: " [0-7]{7,13}"
  filter_main_valid_ip:
    CommandLine|re: https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4}
  condition: selection_command and 1 of selection_ip_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cb5a2333-56cf-4562-8fcb-22ba1bca728d
    type: derived