alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING GET to ip .ipify .org via WinHTTP"; flow:established,to_server; http.method; content:"GET"; http.host; bsize:13; content:"api.ipify.org"; fast_pattern; http.user_agent; content:"Mozilla/4.0"; startswith; content:"WinHttp.WinHttpRequest."; classtype:misc-activity; sid:2072017; rev:1; metadata:affected_product Windows_Client, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_09_11, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, updated_at 2026_09_11, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1082, mitre_technique_name System_Information_Discovery; target:src_ip;)