let ip_check = dynamic(['whatismyipaddress.com', 'ip2location.com', 'ipaddress.my', 'whatismyip.com', 'ipinfo.info', 'checkmyip.com', 'myip.com', 'checkmyip.org', 'canireachthe.net', 'ipv4.icanhazip.com', 'ip.anysrc.net', 'edns.ip-api.com', 'wtfismyip.com', 'checkip.dyndns.org', 'api.2ip.ua', 'icanhazip.com', 'api.ipify.org', 'ip-api.com', 'checkip.amazonaws.com', 'ipecho.net', 'ipinfo.io', 'ipv4bot.whatismyipaddress.com', 'freegeoip.app', 'checkip.azurewebsites.net']);
GCPCloudDNS
| where Query in~ (ip_check)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr
kind: Scheduled
queryFrequency: 1h
queryPeriod: 1h
version: 1.0.0
tactics:
- CommandAndControl
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpCheck.yaml
triggerThreshold: 0
description: |
'Detects requests to ip lookup resources.'
severity: Medium
relevantTechniques:
- T1095
id: 35221a58-cacb-4174-9bb4-ee777784fbce
name: Google DNS - IP check activity
requiredDataConnectors:
- dataTypes:
- GCPCloudDNS
connectorId: GCPDNSDataConnector
query: |
let ip_check = dynamic(['whatismyipaddress.com', 'ip2location.com', 'ipaddress.my', 'whatismyip.com', 'ipinfo.info', 'checkmyip.com', 'myip.com', 'checkmyip.org', 'canireachthe.net', 'ipv4.icanhazip.com', 'ip.anysrc.net', 'edns.ip-api.com', 'wtfismyip.com', 'checkip.dyndns.org', 'api.2ip.ua', 'icanhazip.com', 'api.ipify.org', 'ip-api.com', 'checkip.amazonaws.com', 'ipecho.net', 'ipinfo.io', 'ipv4bot.whatismyipaddress.com', 'freegeoip.app', 'checkip.azurewebsites.net']);
GCPCloudDNS
| where Query in~ (ip_check)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr
entityMappings:
- fieldMappings:
- identifier: DomainName
columnName: DNSCustomEntity
entityType: DNS
- fieldMappings:
- identifier: Address
columnName: IPCustomEntity
entityType: IP
triggerOperator: gt
