Sigma rule: Suspicious Network Communication With IPFS

Rule

Title

Suspicious Network Communication With IPFS

Status

test

Level

low

Author

Gavin Knapp

Date

2023-03-16

File

rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

Log source

category

proxy

Detection

selection:
    cs-uri|re: '(?i)(ipfs\.io/|ipfs\.io\s).+\..+@.+\.[a-z]+'
condition: selection

False positives (as the rule lists them)

• Legitimate use of IPFS being used in the organisation. However the cs-uri regex looking for a user email will likely negate this.

Tags

• attack.collection
• attack.credential-access
• attack.t1056

MITRE ATT&CK ids this rule names

• T1056

References

• https://blog.talosintelligence.com/ipfs-abuse/
• https://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11
• https://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml