Windows Ping Hex IP Usage via Command Line

Flags ping.exe executions that pass a hex-encoded IPv4 address (0x????????) in the command line on Windows.

FreeUnreviewedSigmahighv1

windows-ping-hex-ip-usage-via-command-line-1a0d4aba

title: Windows Ping Hex IP Usage via Command Line
id: d515c5b4-67fe-40dc-9f15-2892a9c24217
status: test
description: This rule identifies execution of ping.exe where the command line contains a hex-encoded IPv4 value formatted as 0x followed by exactly 8 hex characters. Using hex-encoded addresses can help attackers obfuscate target details in process command lines and reduce the chance of straightforward string-based detections. It relies on Windows process creation telemetry, matching ping.exe by filename and extracting the hex pattern from the command line.
references:
  - https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna
  - https://twitter.com/vysecurity/status/977198418354491392
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ping_hex_ip.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-03-23
modified: 2025-10-17
tags:
  - attack.stealth
  - attack.t1140
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \ping.exe
    CommandLine|re: 0x[a-fA-F0-9]{8}
  condition: selection
falsepositives:
  - Unlikely, because no sane admin pings IP addresses in a hexadecimal form
level: high
license: DRL-1.1
related:
  - id: 1a0d4aba-7668-4365-9ce4-6d79ab088dfd
    type: derived

What it detects

This rule identifies execution of ping.exe where the command line contains a hex-encoded IPv4 value formatted as 0x followed by exactly 8 hex characters. Using hex-encoded addresses can help attackers obfuscate target details in process command lines and reduce the chance of straightforward string-based detections. It relies on Windows process creation telemetry, matching ping.exe by filename and extracting the hex pattern from the command line.

Known false positives

Unlikely, because no sane admin pings IP addresses in a hexadecimal form

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.