Update discovery_post_exploitation_external_ip_lookup.toml

"*ipapi.co", "*ip-lookup.net", "*ipstack.com"
austinsonger · Apr 21, 2021 · b57fd60 · b57fd60
1 parent da7d230
commit b57fd60
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/rules/windows/discovery_post_exploitation_external_ip_lookup.toml b/rules/windows/discovery_post_exploitation_external_ip_lookup.toml
@@ -54,7 +54,10 @@ network where network.protocol == "dns" and
         "*myipaddress.com",
         "*showipaddress.com",
         "*whatismyipaddress.com",
-        "*wtfismyip.com"
+        "*wtfismyip.com",
+        "*ipapi.co",
+        "*ip-lookup.net",
+        "*ipstack.com"
     ) and
     /* Insert noisy false positives here */
     not process.executable :