title: Executable Content Downloaded From A Bare IP Address
id: aa5a4f36-7f5b-4fc6-9a45-7222d72d30de
status: experimental
description: |
  Detects a proxy request for an executable or script where the host is an IP address rather
  than a name. Legitimate software distribution uses names and certificates; staging servers
  stood up for a single intrusion frequently do not.
references:
  - https://attack.mitre.org/techniques/T1105/
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: proxy
detection:
  selection_host:
    cs-host|re: '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(:\d{1,5})?$'
  selection_ext:
    c-uri|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.hta'
      - '.vbs'
      - '.js'
      - '.msi'
      - '.bat'
      - '.scr'
  filter_main_private:
    cs-host|startswith:
      - '10.'
      - '192.168.'
      - '127.'
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Internal deployment shares reached by address. The filter removes the common private ranges; add 172.16.0.0/12 by CIDR in your backend, which a string prefix cannot express safely.
  - Appliance firmware fetched by IP from a vendor.
level: medium