Sigma rule: Suspicious Ping/Del Command Combination

Rule

Title

Suspicious Ping/Del Command Combination

Status

test

Level

high

Author

Ilya Krestinichev

Date

2022-11-03

Modified

2024-03-05

File

rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

Log source

product

windows

category

process_creation

Detection

# Note: In the case of sysmon and similar logging utilities, see this discussion https://github.com/SigmaHQ/sigma/discussions/4277
# Example: "C:\Windows\System32\cmd.exe"  /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\User\Desktop\lockbit\lockbit.exe" & Del /f /q "C:\Users\User\Desktop\lockbit\lockbit.exe".
selection_count:
    CommandLine|contains|windash: ' -n '
selection_nul:
    CommandLine|contains: 'Nul' # Covers "> Nul" and ">Nul "
selection_del_param:
    CommandLine|contains|windash:
        - ' -f '
        - ' -q '
selection_all:
    CommandLine|contains|all:
        - 'ping' # Covers "ping" and "ping.exe"
        - 'del '
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1070.004

MITRE ATT&CK ids this rule names

• T1070.004

References

• https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack
• https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf
• https://www.acronis.com/en-us/blog/posts/lockbit-ransomware/
• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml