Windows cmd.exe One-Liner Combining ping and copy

title: Windows cmd.exe One-Liner Combining ping and copy
id: c7890a80-4580-4762-9c29-db5b3fdaa07e
status: test
description: This rule flags Windows process creation events where cmd.exe is invoked with a one-line command containing both "ping" and "copy ", along with specific ping options (" -n ") and copy overwrite behavior (" -y "). Attackers may use this unusual command combination to execute chained actions or staging steps in a compact, less noticeable way. The detection relies on command-line telemetry from process creation logs, matching cmd.exe executions and the presence of the required substrings.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-18
modified: 2024-03-06
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_action:
    CommandLine|contains|all:
      - ping
      - "copy "
  selection_cli_1:
    CommandLine|contains|windash: " -n "
  selection_cli_2:
    CommandLine|contains|windash: " -y "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ded2b07a-d12f-4284-9b76-653e37b6c8b0
    type: derived