Windows CLI usage of obfuscated IP address patterns in ping/arp commands

title: Windows CLI usage of obfuscated IP address patterns in ping/arp commands
id: 58ab330e-16ab-4b37-ab5e-9c0a7e6a19a5
status: test
description: This rule flags Windows process executions of ping.exe or arp.exe where the command line includes patterns consistent with obfuscated or encoded IP representations (e.g., hex prefixes like 0x, URL-encoded fragments, or regex-matched numeric IP forms). Attackers may use these formats to conceal reconnaissance or network targeting details from casual inspection and some logging pipelines. The detection relies on Windows process creation telemetry, matching executable path endings and scanning the command line for specific encoding/obfuscation indicators while excluding cases that match a normal HTTP URL containing a valid IPv4 address.
references:
  - https://h.43z.one/ipconverter/
  - https://twitter.com/Yasser_Elsnbary/status/1553804135354564608
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2022-08-03
modified: 2026-03-16
tags:
  - attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \ping.exe
      - \arp.exe
  selection_ip_1:
    CommandLine|contains:
      - " 0x"
      - //0x
      - .0x
      - .00x
  selection_ip_2:
    CommandLine|contains|all:
      - http://%
      - "%2e"
  selection_ip_3:
    - CommandLine|re: https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4}
    - CommandLine|re: https?://[0-9]{1,3}\.0[0-9]{3,7}
    - CommandLine|re: https?://0[0-9]{3,11}
    - CommandLine|re: https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11}
    - CommandLine|re: https?://0[0-9]{1,11}
    - CommandLine|re: " [0-7]{7,13}"
  filter_main_valid_ip:
    CommandLine|re: https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4}
  condition: selection_img and 1 of selection_ip_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 56d19cb4-6414-4769-9644-1ed35ffbb148
    type: derived