IP address of Windows host encoded in web request

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


This detection will identify network requests in HTTP proxy data that contains Base64 encoded IP addresses. After identifying candidates the query joins with DeviceNetworkEvents to idnetify any machine within the network using that IP address. Alerts indicate that the IP address of a machine within your network was seen with it's IP address base64 encoded in an outbound web request. This method of egressing the IP was seen used in POLONIUM's RunningRAT tool, however the detection is generic.

Attribute Value
Type Analytic Rule
Solution Standalone Content
ID a4ce20ae-a2e4-4d50-b40d-d49f1353b6cc
Severity Medium
Kind Scheduled
Tactics Exfiltration, CommandAndControl
Techniques T1041, T1071.001
Required Connectors Zscaler, Fortinet, CheckPoint, PaloAltoNetworks, MicrosoftThreatProtection
Source View on GitHub

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules