Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.004File Deletion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows command shells (cmd.exe via Sysmon-style Image endswith \cmd.exe and Cmd.Exe original filename) executing a one-line CommandLine that contains both "ping" and "copy ". Attackers and malware commonly combine commands to blend network checks with file staging or transfer in a single command execution. The detection relies on process creation telemetry with cmd.exe image/original filename and full CommandLine content.

Reporting behind it

Related detections9 linkedT1070.004 — drag to rearrange

Suspicious Crontab Removal via Command Line (via process_creation)

Suspicious Self-Deletion via Ping Loopback and Del (via process_creation)

Malicious Self-Deletion Via Fsutil SetZeroData

Self-Deletion via Ping Loopback Delay and Del Command

Suspicious Deletion of Explorer RunMRU Values

Suspicious PowerShell Self-Delete Of Executable via Process Creation

Suspicious Prefetch Deletion for Anti-Forensics

Malicious Ransomware Self-Deletion via Ping Loopback and Del

Suspicious Self-Deletion Batch Artifact by JadeProx TriBack Loader (via file_event)

Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy

Pivot detection · T1070.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-cmd-exe-one-liner-combining-ping-and-copy-ded2b07a

title: "Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy"
id: c7890a80-4580-4762-9c29-db5b3fdaa07e
status: test
description: This rule flags Windows command shells (cmd.exe via Sysmon-style Image endswith \cmd.exe and Cmd.Exe original filename) executing a one-line CommandLine that contains both "ping" and "copy ". Attackers and malware commonly combine commands to blend network checks with file staging or transfer in a single command execution. The detection relies on process creation telemetry with cmd.exe image/original filename and full CommandLine content.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-18
modified: 2024-03-06
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_action:
    CommandLine|contains|all:
      - ping
      - "copy "
  selection_cli_1:
    CommandLine|contains|windash: " -n "
  selection_cli_2:
    CommandLine|contains|windash: " -y "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ded2b07a-d12f-4284-9b76-653e37b6c8b0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL