--- analysis: A simple detection rule for the backslash-GET method or known IPs is easily bypassed by rotation. This hunt adds value by baselining Direct-to-IP behavior across the fleet, allowing an analyst to find unknown threats using the same behavioral profile. blind_spots: - id: incomplete-proxy-visibility question: whether encrypted HTTPS requests use the backslash-GET method or malicious paths requires: hb_http_activity from a decrypted forward proxy risk: Malware using TLS will hide its URI and HTTP method from the surface, leaving only raw IP destination metadata in hb_network_connection. stage: obfuscated-http-exfiltration - id: dns-cache-hits question: whether a connection was truly D2IP or simply missed because the OS cache was used requires: hb_dns_activity covering both live lookups and local cache hits risk: A host might appear to be performing D2IP if its local cache answered the query and the telemetry source only captures live network DNS traffic. stage: dns-bypass-c2 coverage: - stage: direct-to-ip-payload-delivery status: covered steps: - match-known-c2-ips - suspicious-proxy-endpoints - stage: dns-bypass-c2 status: covered steps: - baseline-d2ip-connections - match-known-c2-ips - stage: obfuscated-http-exfiltration status: covered steps: - malformed-backslash-get - stage: in-browser-proxy-theft status: covered steps: - suspicious-proxy-endpoints guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Nearly half of malware with C2 activity bypasses DNS entirely. This hunt correlates connection metadata (D2IP) with application indicators (malformed methods) to identify what standard DNS-based filtering misses. methodology: model-assisted trigger: intel-report hypothesis: An adversary is using hard-coded IP addresses and malformed HTTP protocols to bypass DNS-based security controls, exfiltrate data, and proxy credential theft in real-time. labels: - hunt - attack.t1071.001 - attack.t1568 - attack.t1041 - attack.t1132.001 - attack.t1185 - attack.t1056.001 - attack.t1105 name: D2IP Malware and Obfuscated HTTP Exfiltration parameters: c2_ips: default: - 154.92.19.71 - 178.16.54.109 - 87.120.107.33 - 194.76.227.94 - 2.26.98.67 - 62.60.179.230 - 91.92.243.29 - 103.245.236.146 - 178.16.54.31 - 206.189.229.43 description: Known malicious destination IP addresses from the research. from: kind: article observed: '2024-08-04' ref: unit42-d2ip-2024 type: list[ip] lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2024-08-04' ref: standard-lookback type: number malicious_paths: default: - /churl - /fsave - /new.php - /st.exe description: URI paths associated with Phorpiex and SectopRAT exfiltration and payload delivery. from: kind: article observed: '2024-08-04' ref: unit42-d2ip-2024 type: list[string] scope_hosts: default: [] description: Optional list of hostnames to focus the hunt; leave empty to scan the entire estate. from: kind: manual observed: '2024-08-04' ref: analyst-defined type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Start with general endpoints. If high-fidelity malformed HTTP activity is detected, focus specifically on those hosts and expand the lookback to catch the original infection vector. references: - name: "Unit 42 \u2014 Almost Half of Malware Samples Communicate Direct to IP" url: https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ related: - hunt: standard-http-c2-path-hunting reason: This hunt focuses on connections that lack a preceding DNS resolution; standard hunts assume resolution exists. relation: out-of-scope-alternative scenario: stages: - name: D2IP Payload Delivery observables: - /st.exe - /hiddenbin/ - Wget/1.13.4 - HTTP Range headers - 178.16.54.109 - 2.26.98.67 slug: direct-to-ip-payload-delivery tactic: execution techniques: - T1105 - name: DNS-Bypass Command and Control observables: - wss://154.92.19.71:39989 - 154.92.19.71 - 87.120.107.33 - 194.76.227.94 - Hardcoded IP addresses in binary strings - TCP connections without prior DNS queries slug: dns-bypass-c2 tactic: command-and-control techniques: - T1071.001 - T1568 - name: Obfuscated HTTP Exfiltration observables: - \GET method prefix - URI length 250-666 characters - Hex-like payload encoding - Rotating destination ports and IPs slug: obfuscated-http-exfiltration tactic: exfiltration techniques: - T1041 - T1132.001 - name: In-Browser Proxy Credential Theft observables: - /churl - /fsave - pcid - clid - 87.120.107.33 - 194.76.227.94 slug: in-browser-proxy-theft tactic: credential-access techniques: - T1185 - T1056.001 summary: Nearly half of modern malware samples bypass DNS-based defenses by using direct-to-IP (D2IP) communication for command-and-control and payload delivery. High-profile threats including Phorpiex, SectopRAT, and Mozi botnets utilize this technique to download components, exfiltrate credentials via in-browser proxies, and maintain P2P mesh networks while remaining invisible to DNS security layers. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent network: category: network name: Network telemetry telemetry: - network web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # D2IP Malware and Obfuscated HTTP Exfiltration This hunt identifies malware that avoids DNS resolution, rendering standard DNS-based filtering blind. It focuses on identifying Direct-to-IP (D2IP) connections, corroborating them with malformed HTTP signals like the backslash-GET method and long encoded URIs, and checking for specific browser-proxy endpoints used by SectopRAT for credential theft. It follows a phased approach to link network-level anomalies with application-layer evidence of exfiltration. ## scope-managed-endpoints Identify active hosts in the inventory to provide a baseline for the scope_hosts parameter. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames representing the managed estate. This step is for inventory reference. reads: - device_hostname - package_type silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-20' ~~~ SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE package_type IN ('deb', 'rpm', 'msi', 'pkg') ``` ## early-parallel parallel: - → match-known-c2-ips - → baseline-d2ip-connections join: → early-stage-agent ## match-known-c2-ips Identify any host directly contacting the IP addresses named in the research. ```sqlite target=network role=enrichment params=(c2_ips=c2_ips, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Connections to specific report IPs. Silence is expected if the adversary has rotated their infrastructure. reads: - device_hostname - process_name - dst_endpoint_ip - dst_endpoint_port - time silence: not_evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## baseline-d2ip-connections Find rare outbound connections where the hostname is missing, indicating a D2IP bypass. ```sqlite target=network role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Small clusters of hosts talking to an IP that was never resolved via DNS. Benign tools (like internal admin scripts) will have high host counts. prevalence: by: device_hostname key: - dst_endpoint_ip - process_name rare_below: 3 reads: - dst_endpoint_ip - process_name - device_hostname - dst_endpoint_hostname - direction - time silence: not_evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-09-20' ~~~ SELECT dst_endpoint_ip, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_hostname IS NULL OR dst_endpoint_hostname = '') AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, process_name HAVING host_count <= 3 ORDER BY host_count ASC ``` ## early-stage-agent ```agent target=hunter cite: required context: - match-known-c2-ips - baseline-d2ip-connections max_iterations: 3 objective: Identify hosts making rare or matched outbound connections that bypassed DNS resolution. success_criteria: A verdict of suspicious or malicious for hosts with low-prevalence D2IP traffic. tools: - endpoint - network - web ``` ## follow-on-parallel parallel: - → malformed-backslash-get - → suspicious-proxy-endpoints join: → follow-on-agent ## malformed-backslash-get Find the high-fidelity backslash-GET method and URIs with lengths (250-666) characteristic of exfiltration. ```sqlite target=web role=detection-candidate params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Requests using '\GET' or unusually long URIs. Benign tracking scripts may have long URIs, but the '\GET' string is a definitive malware indicator. reads: - device_hostname - http_method - url_full - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, http_method, url_full, LENGTH(url_full) AS uri_len, time FROM hb_http_activity WHERE (http_method LIKE '%\GET%' OR LENGTH(url_full) BETWEEN 250 AND 666) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## suspicious-proxy-endpoints Find traffic to endpoints used by Phorpiex and SectopRAT for payload delivery and credential exfiltration. ```sqlite target=web role=triage params=(malicious_paths=malicious_paths, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Requests to /churl, /fsave, /st.exe, or hidden directories. Matching these on hosts that also show D2IP behavior confirms a high-confidence threat. reads: - device_hostname - url_path - url_hostname - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, url_path, url_hostname, time FROM hb_http_activity WHERE (instr(',' || '{{malicious_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR url_path LIKE '%/hiddenbin/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## follow-on-agent ```agent target=hunter cite: required context: - early-stage-agent - malformed-backslash-get - suspicious-proxy-endpoints max_iterations: 5 objective: Link D2IP connections from the first phase to malformed HTTP exfiltration or browser-proxy activity in the second phase. success_criteria: A malicious verdict for any host where a D2IP network connection correlates with malformed HTTP methods or known-bad URIs. tools: - endpoint - network - web ``` ## route-on-verdict if~: "the follow-on-agent verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: incomplete-proxy-visibility) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Collect the binary responsible for the network traffic and examine it for hard-coded IP strings. Revoke any browser session tokens used by the host during the lookback period. ``` → analyst-review ## analyst-review ```manual target=analyst Examine the context of the D2IP connections. If the destination is a cloud provider (AWS/Azure) and the URI contains long encoded strings, prioritize the investigation. Verify if the process is a legitimate browser or a standalone binary. ``` → end ## close-out ```manual target=analyst Record the results. If no malicious activity was found, ensure any newly discovered legitimate D2IP admin tools are noted for future exclusions. ``` → end