Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Potentially Suspicious Ping/Copy Command Combination

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
X__Junior (Nextron Systems)Created Tue Jul 18Updated Wed Mar 06ded2b07a-d12f-4284-9b76-653e37b6c8b0windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic4 selectors
detection:
    # Note: In the case of sysmon and similar logging utilities, see this discussion https://github.com/SigmaHQ/sigma/discussions/4277
    selection_cmd:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_action:
        CommandLine|contains|all:
            - 'ping' # Covers "ping" and "ping.exe"
            - 'copy '
    selection_cli_1:
        CommandLine|contains|windash: ' -n ' # Count
    selection_cli_2:
        CommandLine|contains|windash: ' -y '
    condition: all of selection_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
Internal Research
MITRE ATT&CK
Rule Metadata
Rule ID
ded2b07a-d12f-4284-9b76-653e37b6c8b0
Status
test
Level
medium
Type
Detection
Created
Tue Jul 18
Modified
Wed Mar 06
Author
X__Junior (Nextron Systems)
Path
rules/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml
Raw Tags
attack.defense-evasionattack.t1070.004
View on GitHub