Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy

Alerts when cmd.exe runs a one-liner that includes both ping and copy with expected options.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-07-18
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.004File Deletion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows command shells (cmd.exe via Sysmon-style Image endswith \cmd.exe and Cmd.Exe original filename) executing a one-line CommandLine that contains both "ping" and "copy ". Attackers and malware commonly combine commands to blend network checks with file staging or transfer in a single command execution. The detection relies on process creation telemetry with cmd.exe image/original filename and full CommandLine content.

Reporting behind it

Related detections9 linkedT1070.004 — drag to rearrange

Suspicious Self-Delete Chain via Loopback Ping and File Deletion (via process_creation)

Suspicious Anti-Recovery Zeroing via fsutil setZeroData (via process_creation)

Suspicious Zone.Identifier Mark-of-the-Web Removal (via process_creation)

Suspicious Self-Deletion of Dropper via Command Line

Suspicious Self-Deletion via Choice Timer and Del Command via Cmd (via process_creation)

Suspicious Jump List AutomaticDestinations Deletion via Cmd (via process_creation)

Suspicious Self-Delete via cmd choice Timeout and Del

Suspicious Ping Loopback Delay Followed by File Deletion for Evasion

Suspicious Alternate Data Stream Self-Deletion via process_creation

Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy

Pivot detection · T1070.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-cmd-exe-one-liner-combining-ping-and-copy-ded2b07a

title: "Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy"
id: c7890a80-4580-4762-9c29-db5b3fdaa07e
status: test
description: This rule flags Windows command shells (cmd.exe via Sysmon-style Image endswith \cmd.exe and Cmd.Exe original filename) executing a one-line CommandLine that contains both "ping" and "copy ". Attackers and malware commonly combine commands to blend network checks with file staging or transfer in a single command execution. The detection relies on process creation telemetry with cmd.exe image/original filename and full CommandLine content.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-18
modified: 2024-03-06
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_action:
    CommandLine|contains|all:
      - ping
      - "copy "
  selection_cli_1:
    CommandLine|contains|windash: " -n "
  selection_cli_2:
    CommandLine|contains|windash: " -y "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ded2b07a-d12f-4284-9b76-653e37b6c8b0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL