huntrule

Windows Ping Hex IP Usage via Command Line

Flags ping.exe executions that pass a hex-encoded IPv4 address (0x????????) in the command line on Windows.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2018-03-23
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies execution of ping.exe where the command line contains a hex-encoded IPv4 value formatted as 0x followed by exactly 8 hex characters. Using hex-encoded addresses can help attackers obfuscate target details in process command lines and reduce the chance of straightforward string-based detections. It relies on Windows process creation telemetry, matching ping.exe by filename and extracting the hex pattern from the command line.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange
Suspicious Python Inline Deobfuscation and Execution One-Liner
Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)
AutoIt Payload Reassembly via copy /b File Concatenation
PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)
Suspicious XOR-Encoded PowerShell Command Line (Windows Process Creation)
Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)
Suspicious XOR Obfuscated PowerShell from ClickFix Distribution
Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell
Suspicious lwp-download Retrieval of Remote File Masquerading as Image via 8220 Gang
Windows Ping Hex IP Usage via Command Line
Pivot detection · T1027 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.