Merge PR #4526 from @fukusuket - Remove Look-Ahead Regex

update: Obfuscated IP Download Activity --------- Co-authored-by: Nasreddine Bencherchali <[email protected]>
SigmaHQ · Oct 30, 2023 · b92a0fe · b92a0fe
1 parent c919ff9
commit b92a0fe
Showing 1 changed file with 9 additions and 7 deletions.
diff --git a/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml b/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml
@@ -8,7 +8,7 @@ references:
     - https://twitter.com/fr0s7_/status/1712780207105404948
 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems)
 date: 2022/08/03
-modified: 2023/10/24
+modified: 2023/10/29
 tags:
     - attack.discovery
 logsource:
@@ -34,16 +34,18 @@ detection:
             - '%2e'
     selection_ip_3:
         # http://81.4.31754
-        - CommandLine|re: 'https?:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,5}(?!.)'
+        - CommandLine|re: 'https?://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,5}'
         # http://81.293898
-        - CommandLine|re: 'https?:\/\/[0-9]{1,3}\.[0-9]{1,8}(?!.)'
+        - CommandLine|re: 'https?://[0-9]{1,3}\.[0-9]{1,8}'
         # http://1359248394
-        - CommandLine|re: 'https?:\/\/[0-9]{1,10}(?!.)'
+        - CommandLine|re: 'https?://[0-9]{1,10}'
         # http://0121.04.0174.012
-        - CommandLine|re: 'https?:\/\/(0[0-9]{1,11}\.){3}0[0-9]{1,11}'
+        - CommandLine|re: 'https?://(0[0-9]{1,11}\.){3}0[0-9]{1,11}'
         # http://012101076012
-        - CommandLine|re: 'https?:\/\/0[0-9]{1,11}(?!.)'
-    condition: selection_command and 1 of selection_ip_*
+        - CommandLine|re: 'https?://0[0-9]{1,11}'
+    filter_main_valid_ip:
+        CommandLine|re: 'https?://((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}'
+    condition: selection_command and 1 of selection_ip_* and not 1 of filter_main_*
 falsepositives:
     - Unknown
 level: medium