huntrule

Windows Ping Hex IP Usage via Command Line

Flags ping.exe executions that pass a hex-encoded IPv4 address (0x????????) in the command line on Windows.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2018-03-23
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies execution of ping.exe where the command line contains a hex-encoded IPv4 value formatted as 0x followed by exactly 8 hex characters. Using hex-encoded addresses can help attackers obfuscate target details in process command lines and reduce the chance of straightforward string-based detections. It relies on Windows process creation telemetry, matching ping.exe by filename and extracting the hex pattern from the command line.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange
Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)
AutoIt Payload Reassembly via copy /b File Concatenation
PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)
Suspicious XOR-Encoded PowerShell Command Line (Windows Process Creation)
Suspicious PowerShell Invoke-Expression with Replace Obfuscation
Suspicious Base64 Decoded Payload Piped to Shell
Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell
Suspicious Python Interpreter Launching Encoded PowerShell via subprocess
Suspicious PowerShell Download Of Text-Disguised Payload
Windows Ping Hex IP Usage via Command Line
Pivot detection · T1027 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.