External IP address in Command Line

Hunt Hypothesis

Attackers may use hardcoded external IP addresses in command lines to establish C2 or exfiltrate data, indicating potential malicious network communication. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage adversary activity that could evade traditional detection methods.

KQL Query

// Add any expected range prefixes here
  let exclusion_ranges = dynamic([""]);
  let ipv4_regex = "([^ ](\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}|(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ])";
  let processes = dynamic(["cmd.exe", "powershell"]);
  SecurityEvent
  | where EventID == 4688
  | where Process has_any(processes)
  | extend IP = extract(ipv4_regex, 1, CommandLine)
  | where isnotempty(IP)
  | where not(ipv4_is_private(IP))
  | where not(has_any_ipv4_prefix(IP, exclusion_ranges))
  | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hosts=makeset(Computer), Accounts=makeset(Account) by IP, CommandLine, Process
  | extend Host_count = array_length(Hosts)
  | sort by Host_count desc
  | project-reorder Host_count, IP, Process, CommandLine

Analytic Rule Definition

id: 2f6032ac-bb18-48b0-855a-7b05cf074957
name: External IP address in Command Line
description: |
  'This query looks for command lines that contain a public IP address. Attackers may use a hard coded IP for C2 or exfiltration.
    This query can be filtered to exclude network prefixes that are known to be legitimate.'
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvents
tactics:
  - CommandAndControl
  - Exfiltration
relevantTechniques:
  - T1041
  - T1071
query: |
  // Add any expected range prefixes here
    let exclusion_ranges = dynamic([""]);
    let ipv4_regex = "([^ ](\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}|(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ])";
    let processes = dynamic(["cmd.exe", "powershell"]);
    SecurityEvent
    | where EventID == 4688
    | where Process has_any(processes)
    | extend IP = extract(ipv4_regex, 1, CommandLine)
    | where isnotempty(IP)
    | where not(ipv4_is_private(IP))
    | where not(has_any_ipv4_prefix(IP, exclusion_ranges))
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hosts=makeset(Computer), Accounts=makeset(Account) by IP, CommandLine, Process
    | extend Host_count = array_length(Hosts)
    | sort by Host_count desc
    | project-reorder Host_count, IP, Process, CommandLine
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IP
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Community
    categories:
        domains: [ "Security - Network" ]

Required Data Sources

MITRE ATT&CK Context

• Tactic: CommandAndControl
• Tactic: Exfiltration
• Technique: T1041 — T1041
• Technique: T1071 — T1071

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/SecurityEvent/ExternalIPaddressinCommandLine.yaml)

False Positive Guidance

• Scenario: Scheduled System Update via CLI
  Description: A system administrator runs a scheduled update command that includes an IP address as part of a remote server address (e.g., rsync --server --output=... ssh://[email protected]/path).
  Filter/Exclusion: Exclude IP addresses associated with internal network ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or include a whitelist of known update servers.

• Scenario: Log Collection via CLI with External Monitoring Tool
  Description: An admin uses a command like curl https://logs.example-monitoring.com/api/v1/logs to send logs to an external monitoring service.
  Filter/Exclusion: Exclude IP addresses from known monitoring services (e.g., logs.example-monitoring.com) or use a domain-based filter to exclude traffic to specific domains.

• Scenario: Database Backup to Cloud Storage
  Description: A DBA runs a backup command like mysqldump -u user -p --host=cloud-db.example.com database > backup.sql to store backups in a cloud storage service.
  Filter/Exclusion: Exclude IP addresses or domains associated with cloud storage services (e.g., cloud-db.example.com) or use a whitelist of approved cloud services.

• Scenario: Remote Desktop Connection (RDP) via CLI
  Description: An admin uses mstsc /v:192.168.1.50 to connect to a remote desktop server.
  Filter/Exclusion: Exclude internal IP addresses or use a whitelist of approved RDP servers within the enterprise network.

• **Scenario: DNS Query via CLI