Windows CLI usage of obfuscated IP address patterns in ping/arp commands
Alerts when ping or arp command lines include obfuscated/encoded IP address indicators on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-03
- Updated
- 2026-07-30
What it detects
This rule flags Windows process executions of ping.exe or arp.exe where the command line includes patterns consistent with obfuscated or encoded IP representations (e.g., hex prefixes like 0x, URL-encoded fragments, or regex-matched numeric IP forms). Attackers may use these formats to conceal reconnaissance or network targeting details from casual inspection and some logging pipelines. The detection relies on Windows process creation telemetry, matching executable path endings and scanning the command line for specific encoding/obfuscation indicators while excluding cases that match a normal HTTP URL containing a valid IPv4 address.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows CLI usage of obfuscated IP address patterns in ping/arp commands
id: 58ab330e-16ab-4b37-ab5e-9c0a7e6a19a5
status: test
description: This rule flags Windows process executions of ping.exe or arp.exe where the command line includes patterns consistent with obfuscated or encoded IP representations (e.g., hex prefixes like 0x, URL-encoded fragments, or regex-matched numeric IP forms). Attackers may use these formats to conceal reconnaissance or network targeting details from casual inspection and some logging pipelines. The detection relies on Windows process creation telemetry, matching executable path endings and scanning the command line for specific encoding/obfuscation indicators while excluding cases that match a normal HTTP URL containing a valid IPv4 address.
references:
- https://h.43z.one/ipconverter/
- https://twitter.com/Yasser_Elsnbary/status/1553804135354564608
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2022-08-03
modified: 2026-03-16
tags:
- attack.discovery
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \ping.exe
- \arp.exe
selection_ip_1:
CommandLine|contains:
- " 0x"
- //0x
- .0x
- .00x
selection_ip_2:
CommandLine|contains|all:
- http://%
- "%2e"
selection_ip_3:
- CommandLine|re: https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4}
- CommandLine|re: https?://[0-9]{1,3}\.0[0-9]{3,7}
- CommandLine|re: https?://0[0-9]{3,11}
- CommandLine|re: https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11}
- CommandLine|re: https?://0[0-9]{1,11}
- CommandLine|re: " [0-7]{7,13}"
filter_main_valid_ip:
CommandLine|re: https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4}
condition: selection_img and 1 of selection_ip_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 56d19cb4-6414-4769-9644-1ed35ffbb148
type: derived