huntrule

Suspicious Execution Delay via Ping Localhost to Null via process_creation

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-17
Updated
2026-10-17
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the execution delay trick used by the Spectre Ops stealer where cmd runs ping localhost with a count and redirects output to nul to sleep between stages. This ping based sleep evades sandbox timing and paces the infection chain. While some scripts use ping delays benignly, the localhost count and null redirection combination is a common malware self throttling pattern worth surfacing.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange
Suspicious Scheduled Task Masquerading as Google Chrome Updates via Process Creation
Suspicious APT42 Command Obfuscation via Environment Variable Substitution and Call (via process_creation)
Suspicious Domain Admins Group Enumeration via Net Command (via process_creation)
Suspicious Child Process Spawned by Notepad++ Updater GUP
Suspicious Host Reconnaissance Command Chain via cmd
Suspicious PIF AutoIt Interpreter Executing a3x Compiled Script
Malicious Netcat SSL Reverse Shell Execution via process_creation
Suspicious Executable Execution From Users Public Directory via Process Creation
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Suspicious Execution Delay via Ping Localhost to Null via process_creation
Pivot detection · T1059.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.