Add additional links for known IP obtaining services

Signed-off-by: Still Hsu <dev@stillu.cc>
mandiant · Jan 4, 2024 · 04346a8 · 04346a8
1 parent 103fafa
commit 04346a8
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/collection/network/capture-public-ip.yml b/collection/network/capture-public-ip.yml
@@ -4,13 +4,15 @@ rule:
     namespace: collection/network
     authors:
       - "@_re_fox"
+      - "still@teamt5.org"
     scopes:
       static: function
       dynamic: thread
     att&ck:
       - Discovery::System Network Configuration Discovery [T1016]
     examples:
       - 84f1b049fa8962b215a77f51af6714b3:0x100061e5
+      - 6d952a7e66bc63b72c9a3d10ef28e3f2
   features:
     - and:
       - api: InternetOpen
@@ -28,3 +30,10 @@ rule:
         - substring: "wtfismyip.com/text"
         - substring: "api.myip.com"
         - substring: "ip-api.com/line"
+        - substring: "ip.tool.chinaz.com"
+        - substring: "1234i.com"
+        - substring: "ip138.com"
+        - substring: "myip.com.tw"
+        - substring: "taobao.com/help/getip.php"
+        - substring: "chaipip.com"
+        - substring: "sojson.com/ip"